Joomla CMS up to 3.9.2 Protection Mechanism phar Stream Object Injection injection

Summaryinfo

A vulnerability was found in Joomla CMS up to 3.9.2. It has been rated as critical. The affected element is an unknown function of the component Protection Mechanism. Performing a manipulation as part of phar Stream results in injection (Object Injection). This vulnerability is identified as CVE-2019-7743. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in Joomla CMS up to 3.9.2 (Content Management System). This affects an unknown function of the component Protection Mechanism. The manipulation as part of a phar Stream leads to a injection vulnerability (Object Injection). CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

The bug was discovered 02/12/2019. The weakness was released 02/12/2019 (Website). It is possible to read the advisory at securityfocus.com. This vulnerability is uniquely identified as CVE-2019-7743 since 02/11/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 13418 (Joomla! Prior to 3.9.3 Multiple Vulnerabilities).

Upgrading to version 3.9.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 107015†). Entries connected to this vulnerability are available at VDB-130847, VDB-130848, VDB-130849 and VDB-130852. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Joomla

Name

• CMS

Version

• 3.9.0
• 3.9.1
• 3.9.2

License

• open-source

Website

• Vendor: https://www.joomla.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion