Exploiting Joomla! Component com_biblestudy for Local File Inclusion

What this paper is

This paper describes a Local File Inclusion (LFI) vulnerability in the com_biblestudy component for Joomla! versions prior to its fix. The vulnerability allows an attacker to include and execute arbitrary files from the server's filesystem by manipulating the id parameter in a specific URL.

Simple technical breakdown

The com_biblestudy component, when processing requests, uses the id parameter to determine which study file to load. Due to insufficient input validation, an attacker can provide a path traversal sequence (like ../../) within the id parameter. This allows them to bypass intended directory restrictions and include files that are not meant to be publicly accessible, such as configuration files or even script files that could lead to remote code execution.

Complete code and payload walkthrough

The provided exploit snippet is not actual code but a URL pattern demonstrating the vulnerability.

http://server/ [Yol] /index.php?option=com_biblestudy&id=1&view=studieslist&controller= [-LFI-]

Let's break down the components of this URL:

• http://server/: This is the base URL of the vulnerable Joomla! website.
• [Yol]: This appears to be a placeholder or a comment from the author, indicating the location where the LFI attack string would be inserted. It's not part of the actual exploit mechanism.
• index.php: The main entry point for Joomla! applications.
• option=com_biblestudy: This parameter tells Joomla! to load the com_biblestudy component.
• id=1: This is a legitimate parameter, likely used to specify a particular study. The vulnerability lies in how this parameter is processed.
• view=studieslist: Specifies the view within the component to be rendered.
• controller=: This parameter is present but empty. It might be intended for further control flow within the component, but its emptiness here is relevant to the exploit.
• [-LFI-]: This is another placeholder from the author, indicating where the LFI payload (the path traversal and target file) would be inserted.

The actual LFI payload would replace [-LFI-] and potentially modify id=1 to include path traversal characters and the desired file path.

For example, a typical LFI payload to include a configuration file like configuration.php (which contains database credentials) might look like this:

id=../../../../../../../../etc/passwd%00

• id=: The parameter being manipulated.
• ../../../../../../../../: This is the path traversal sequence. It moves up the directory tree multiple levels to escape the component's intended directory. The exact number of ../ depends on the depth of the com_biblestudy component within the Joomla! installation.
• etc/passwd: The target file to be included. In this example, it's the standard Unix password file, which is often readable by web servers.
• %00: This is the URL-encoded null byte. In older PHP versions, a null byte could terminate string operations, effectively truncating the filename after the null byte. This was often used to bypass file extension checks or other sanitization mechanisms.

Mapping list:

• index.php?option=com_biblestudy: Initiates the com_biblestudy component.
• id=...: The vulnerable parameter that accepts user-controlled input for file inclusion.
• ../../...: Path traversal characters to navigate the filesystem.
• target_file: The specific file to be included (e.g., configuration.php, /etc/passwd).
• %00 (null byte): Used to truncate filenames and bypass potential sanitization.

Shellcode/Payload Segments:

This paper does not contain explicit shellcode or a binary payload. The "payload" in this context refers to the crafted URL string that exploits the LFI vulnerability. The effect of a successful LFI can be:

1. Information Disclosure: Reading sensitive files like configuration.php (containing database credentials), /etc/passwd, or other system configuration files.
2. Remote Code Execution (RCE): If the LFI can be used to include a file that is then executed by the web server (e.g., a PHP file uploaded to a writable directory, or a log file that can be poisoned with PHP code), it can lead to RCE. This typically involves a two-step process: first, the LFI to include a file that allows execution, and second, a method to get code into that file.

Practical details for offensive operations teams

• Required Access Level: Low. This is a remote, unauthenticated vulnerability.
• Lab Preconditions:
  • A vulnerable Joomla! installation with the com_biblestudy component installed.
  • Knowledge of the Joomla! installation path on the target server to correctly craft path traversal sequences.
  • A web server environment (e.g., Apache, Nginx) running PHP.
• Tooling Assumptions:
  • A web browser for manual testing.
  • A web proxy (e.g., Burp Suite, OWASP ZAP) to intercept and modify requests.
  • A vulnerability scanner that can be configured to test for LFI in specific components.
  • Scripting languages (Python, PHP) for automating the exploitation process.
• Execution Pitfalls:
  • Incorrect Path Traversal Depth: Using too few or too many ../ sequences will result in the target file not being found. This requires enumeration.
  • Null Byte Bypass Failure: Modern PHP versions or specific server configurations might not be vulnerable to the null byte truncation. Alternative bypasses might be needed.
  • File Permissions: The web server user must have read permissions for the target file.
  • Web Application Firewalls (WAFs): WAFs might detect and block common LFI patterns, requiring obfuscation techniques.
  • Component Version: The vulnerability is specific to certain versions of com_biblestudy. Verifying the version is crucial.
• Tradecraft Considerations:
  • Reconnaissance: Identify the target application (Joomla!) and the specific component (com_biblestudy).
  • Enumeration: Determine the Joomla! installation path and the component's relative path to craft accurate LFI payloads. This can often be done by trying different path traversal depths and observing error messages or successful inclusions.
  • Payload Crafting: Experiment with different target files (e.g., configuration.php, /etc/passwd, log files) and LFI bypass techniques if the initial attempts fail.
  • Staging: If the goal is RCE, the LFI is often the first stage to gain access to a file that can be manipulated or to include a malicious script.

Where this was used and when

This vulnerability was published in January 2010. It would have been relevant for attacks targeting Joomla! websites using the com_biblestudy component around that time. LFI vulnerabilities in web applications are a persistent class of issues, and while this specific component might be outdated, the principles of LFI exploitation remain relevant.

Defensive lessons for modern teams

• Input Validation: Always validate and sanitize user-supplied input, especially parameters used in file operations. Ensure that input is restricted to expected values and formats.
• Least Privilege: Configure web server processes to run with the minimum necessary privileges. This limits the impact of a successful file inclusion attack.
• Secure Configuration: Avoid storing sensitive information (like database credentials) in files that are accessible via the web server. Use environment variables or secure configuration management systems.
• Regular Patching: Keep all web applications, CMS platforms (like Joomla!), and their extensions updated to the latest secure versions.
• WAF Implementation: Deploy and properly configure Web Application Firewalls to detect and block common attack patterns, including LFI attempts.
• File Inclusion Prevention: Implement server-side checks to prevent the inclusion of arbitrary files. For example, use a whitelist of allowed file types or ensure that included files are within a designated, secure directory.

ASCII visual (if applicable)

+-----------------+       +-----------------+       +-----------------+
| Attacker's      | ----> | Web Server      | ----> | Joomla! App     |
| Machine         |       | (e.g., Apache)  |       | (index.php)     |
+-----------------+       +-----------------+       +-----------------+
                                                            |
                                                            v
                                                    +-----------------+
                                                    | com_biblestudy  |
                                                    | Component       |
                                                    +-----------------+
                                                            |
                                                            v
                                                    +-----------------+
                                                    | Vulnerable      |
                                                    | 'id' parameter  |
                                                    | processing      |
                                                    +-----------------+
                                                            |
                                                            v
                                                    +-----------------+
                                                    | File System     |
                                                    | (e.g., /etc/passwd) |
                                                    +-----------------+

This diagram illustrates the flow: the attacker sends a crafted URL to the web server, which passes it to the Joomla! application. The com_biblestudy component, due to the vulnerable id parameter processing, attempts to include a file from the server's file system, potentially revealing sensitive information.

Source references

• Paper ID: 10943
• Paper Title: Joomla! Component com_biblestudy - Local File Inclusion
• Author: FL0RiX
• Published: 2010-01-03
• Keywords: PHP, webapps
• Paper URL: https://www.exploit-db.com/papers/10943

Original Exploit-DB Content (Verbatim)

@~~=======================================~~@
@~~=Script   : Joomla Component com_biblestudy

@~~=Author   : FL0RiX

@~~=Greez : Deep-Power ,Pyske,Wretch-x & All Friends

@~~=Bug Type : Local File Inlusion

@~~=Dork : inurl:"com_biblestudy"

@~~=======================================~~@

@~~=Vuln

: http://server/ [Yol] /index.php?option=com_biblestudy&id=1&view=studieslist&controller= [-LFI-]