[EXPLOIT] - TinyMCE on Joomla 1.5.12 RCE upload vulnerability

For those who have not yet upgraded Joomla to the latest version 1.5.15 to point out yet another vulnerability found in earlier versions.

This time it is a Remote Command Execution exploiting a vulnerability that allows to upload files dell'utilizzatissimo TinyMCE that, theoretically, should be prohibited. The vulnerability was discovered by the Italian Luca "Daath" De Fulgentis who explained in detail the 'exploits in his blog .

From the website of Offensive-Security , which will replace the well-known milw0rm , now closed, you can download the exploit that allows PHP to upload any file simply eseguend php exploit by your shell.

As previously mentioned the hack exploits a vulnerability in TinyMCE. This editor uses an array where they are declared file extensions that can not be uploaded but by modifying the HTTP headers you can upload a file with an accepted and then rename the file to make the same TinyMCE.

Obviously there is a system of "security" in the script editor, but unfortunately, it is a simple check of an MD5 hash generated from the concatenation of the absolute path with a variable called "$ tinybrowser ['obfuscate']" which is set default to "s0merand0mjunk! 111" in the file "config_tinybrowser.php" found at the following location:

This rather the system of "safety" (or rather, the vulnerability) File "upload_file.php" that verifies the MD5 Hash:

The 'exploits created by Daath once mentioned the "Site victim" first shall bypass this mechanism by performing a Path Disclosure. With this technique you query a file incorrectly so as to show a typical PHP error screen that shows the absolute path of the file in error. Once you have this information you can recreate the MD5 Hash (absolute path + 's0merand0mjunk! 111') through which to launch a HTTP POST to upload files. The file, of course, must have a valid extension, for example, ". Jpg."

Once the upload is done by sending a second query Http data necessary to rename the file to run. "Jpg" (or whatever extension you chose) to. "Php".

At this point you will have a shell on the site and you can perform any action allowed to the user's web site is the victim.

As mentioned at the beginning of Article Always ensure to update to latest releases your web applications!