Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PRP: CVE-2023-23752 Joomla Improper AccessCheck in WebService Endpoint #276

Open
am0o0 opened this issue Feb 19, 2023 · 7 comments · May be fixed by #369
Open

PRP: CVE-2023-23752 Joomla Improper AccessCheck in WebService Endpoint #276

am0o0 opened this issue Feb 19, 2023 · 7 comments · May be fixed by #369
Assignees
@am0o0
Labels
Contributor main The main issue a contributor is working on (top of the contribution queue). PRP:Accepted

Comments

@am0o0
Copy link
Contributor

am0o0 commented Feb 19, 2023 •
edited

Hi, I'd like to write a plugin for CVE-2023-23752 which is a critical and emergent vulnerability ( Released two days ago) .

Reference:
full report and explanations of this CVE
CVE Page

Description:
from Reference

Joomla has provided the Rest API since version 4.0. These apis need to provide authentication information when accessing, but if public is added to the request parameters when accessing the api Then any unauthenticated user can directly access.

Note that Tsunami can detect this vulnerability as it is a simple get request with following path /api/index.php/v1/config/application?public=true, detector should get a 200 status code and check some JSON fields.
@maoning
Copy link
Collaborator

maoning commented Feb 21, 2023

Hi @amammad,

Thanks for your request! This vulnerability is in scope for the reward program. Please submit our participation form and you can start working on the development.

Please keep in mind that the Tsunami Scanner Team will only be able to work at one issue at a time for each participant so please hold on the implementation work for any other requests you might have.

Thanks!

@am0o0 am0o0 mentioned this issue Feb 23, 2023
Merged
@am0o0
Copy link
Contributor Author

am0o0 commented Mar 23, 2023

Hi, this vulnerability can lead to RCE (from externally exposed MySQL servers)
ref: https://vulncheck.com/blog/joomla-for-rce

@maoning
Copy link
Collaborator

maoning commented Mar 28, 2023

Thanks for the follow up, I will start reviewing the pull request this week!

@am0o0
Copy link
Contributor Author

am0o0 commented Dec 21, 2023

Hi @maoning I see that my PR is merged now so I filled out the new form for this submission.

@am0o0
Copy link
Contributor Author

am0o0 commented Dec 21, 2023

CC for @tooryx

@tooryx
Copy link
Member

tooryx commented Dec 21, 2023

Hi @am0o0,

Unfortunately it seems like copybara[bot] wrongly flagged the PR as merged when I merged the confluence one, but its review is not complete. Please bear with us, we will continue the review of this plugin after the holiday season. Apologies for the misbehavior here.

~tooryx

@tooryx
Copy link
Member

tooryx commented Feb 1, 2024

Hi @am0o0,

I have labeled your other issues as "Contributor queue" for now. We are enforcing more strictly the one review per contributor as we cannot keep up with review otherwise. We will review this plugin and then dequeue the other ones progressively. If you would rather prioritize one of your other contributions instead, let me know.

If you think I incorrectly labeled one of the issues, please let me know.
~tooryx

@tooryx tooryx added the Contributor main The main issue a contributor is working on (top of the contribution queue). label Feb 1, 2024
@tooryx tooryx linked a pull request Feb 1, 2024 that will close this issue
Joomla Improper AccessCheck in WebService Endpoint #369
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@am0o0 am0o0

Labels
Contributor main The main issue a contributor is working on (top of the contribution queue). PRP:Accepted
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Joomla Improper AccessCheck in WebService Endpoint am0o0/tsunami-security-scanner-plugins
3 participants
@tooryx @maoning @am0o0