Rapid7 Vulnerability & Exploit Database

Joomla HTTP Header Unauthenticated Remote Code Execution

Back to Search

Joomla HTTP Header Unauthenticated Remote Code Execution



Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5. By storing user supplied headers in the databases session table it's possible to truncate the input by sending an UTF-8 character. The custom created payload is then executed once the session is read from the database. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. In later versions the deserialisation of invalid session data stops on the first error and the exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and 5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1.


  • Marc-Alexandre Montpas
  • Christian Mehlmauer <FireFart@gmail.com>






Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/multi/http/joomla_http_header_rce
msf exploit(joomla_http_header_rce) > show targets
msf exploit(joomla_http_header_rce) > set TARGET < target-id >
msf exploit(joomla_http_header_rce) > show options
    ...show and set options...
msf exploit(joomla_http_header_rce) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security