K2 Plugin up to 2.7.1 on Joomla File Upload cross-site request forgery

Summaryinfo

A vulnerability marked as problematic has been reported in K2 Plugin up to 2.7.1 on Joomla. The impacted element is an unknown function of the component File Upload. This manipulation causes cross-site request forgery. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Detailsinfo

A vulnerability classified as critical was found in K2 Plugin up to 2.7.1 on Joomla (Joomla Component). Affected by this vulnerability is an unknown code of the component File Upload. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was disclosed 11/19/2016 by Anti Räis as Joomla plugin K2 RCE via CSRF or WCI as confirmed mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The vendor was not involved in the public release. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. The advisory points out:

The file upload functionality isn't protected by CSRF token, which makes it possible to exploit it by constructing a malicious request, which on execution exploits the vulnerability, while the victim visits the attacker controlled site.

A public exploit has been developed by Anti Räis and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 105 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-93726 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Joomla Component

Name

• K2 Plugin

Version

• 2.7.0
• 2.7.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion