Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.

The Joomla! application running on the remote web server is affected by a remote code execution vulnerability due to improper sanitization of the User-Agent header field when saving session values. An unauthenticated, remote attacker can exploit this, via a serialized PHP object, to execute arbitrary PHP code.

The JSST and the Joomla! Security Center report : [20151201] - Core - Remote Code Execution Vulnerability Browser information is not filtered properly while saving the session values into the database which leads to a Remote Code Execution vulnerability. [20151202] - Core - CSRF Hardening Add additional CSRF hardening in com_templates.
[20151203] - Core - Directory Traversal Failure to properly sanitize input data from the XML install file located within an extension's package archive allows for directory traversal. [20151204] - Core - Directory Traversal Inadequate filtering of request data leads to a Directory Traversal vulnerability.

According to its self-reported version number, the Joomla! installation running on the remote web server is prior to 3.4.6. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper sanitization of session values. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2015-8562)

  - A cross-site request forgery (XSRF) vulnerability exists     due to HTTP requests to com_templates not requiring     multiple steps, explicit confirmation, or a unique token     when performing certain sensitive actions. An     unauthenticated, remote attacker can exploit this, by     convincing a user to follow a specially crafted link, to     cause the user to perform unspecified actions.
    (CVE-2015-8563)

  - A path traversal vulnerability exists due to improper     sanitization of user-supplied input via the XML install     file. (CVE-2015-8564)

  - A path traversal vulnerability exists due to improper     sanitization of input supplied via user requests.
    (CVE-2015-8565)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
98222	Joomla! User-Agent Object Injection RCE	Web App Scanning	Component Vulnerability	critical
88489	Joomla! User-Agent Object Injection RCE	Nessus	CGI abuses	critical
87483	FreeBSD : joomla -- multiple vulnerabilities (a9f60ce8-a4e0-11e5-b864-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	high
87416	Joomla! < 3.4.6 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2015-8562

critical

Tenable Plugins

critical

critical

high

critical