Vulnerability & Exploit Database

Back to search

Joomla HTTP Header Unauthenticated Remote Code Execution

Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5. By storing user supplied headers in the databases session table it's possible to truncate the input by sending an UTF-8 character. The custom created payload is then executed once the session is read from the databse. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. In later versions the deserialisation of invalid session data stops on the first error and the exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and 5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1.

Free Metasploit Download

Get your copy of the world's leading penetration testing tool

 Download Now

Module Name

exploit/multi/http/joomla_http_header_rce

Authors

  • Marc-Alexandre Montpas
  • Christian Mehlmauer <FireFart [at] gmail.com>

References

Targets

  • Joomla 1.5.0 - 3.4.5

Platforms

  • php

Architectures

  • php

Reliability

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/joomla_http_header_rce msf exploit(joomla_http_header_rce) > show targets ...targets... msf exploit(joomla_http_header_rce) > set TARGET <target-id> msf exploit(joomla_http_header_rce) > show options ...show and set options... msf exploit(joomla_http_header_rce) > exploit

Related Vulnerabilities