PT-2016-7601 · Open Source Matters · Joomla!

Demis Palma · Publicado 2016-11-04 · Atualizado 2017-07-29 · CVE-2016-8870

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.6.4

Description The issue concerns the register method in the UsersModelRegistration class, which fails to check the Allow User Registration configuration setting when registration has been disabled. This allows remote attackers to create user accounts.

Recommendations For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. As a temporary workaround, consider disabling the registration functionality until a patch is available. Restrict access to the Users component to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-8870

Produtos afetados

Joomla!

Referências · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/joomla_registration_privesc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40637 · Exploit
• https://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf · Correção
• https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8870 · Nota
• https://medium.com/%40showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4r · Nota
• https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html · Aviso do Fabricante
• http://securitytracker.com/id/1037107 · Nota
• http://securityfocus.com/bid/93876 · Nota
• http://securitytracker.com/id/1037108 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8870 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8870 · Aviso do Fabricante
• http://rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc · Nota