PT-2016-7601 · Open Source Matters · Joomla!

Demis Palma · Published 2016-11-04 · Updated 2017-07-29 · CVE-2016-8870

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.6.4

Description The issue concerns the register method in the UsersModelRegistration class, which fails to check the Allow User Registration configuration setting when registration has been disabled. This allows remote attackers to create user accounts.

Recommendations For versions prior to 3.6.4, update to version 3.6.4 or later to resolve the issue. As a temporary workaround, consider disabling the registration functionality until a patch is available. Restrict access to the Users component to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-8870

Affected Products

Joomla!

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/joomla_registration_privesc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/40637 · Exploit
• https://github.com/joomla/joomla-cms/commit/bae1d43938c878480cfd73671e4945211538fdcf · Patch
• https://developer.joomla.org/security-centre/659-20161001-core-account-creation.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8870 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8870 · Vendor Advisory
• https://blog.sucuri.net/2016/10/details-on-the-privilege-escalation-vulnerability-in-joomla.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8870 · Note
• https://medium.com/%40showthread/joomla-3-6-4-account-creation-elevated-privileges-write-up-and-exploit-965d8fb46fa2#.rq4qh1v4r · Note
• http://securitytracker.com/id/1037107 · Note
• http://securityfocus.com/bid/93876 · Note
• http://securitytracker.com/id/1037108 · Note
• http://rapid7.com/db/modules/auxiliary/admin/http/joomla_registration_privesc · Note