Exploiting Joomla! Component SmartSite 1.0.0: A Local File Inclusion Deep Dive

What this paper is

This paper details a Local File Inclusion (LFI) vulnerability found in the Joomla! component named "SmartSite" version 1.0.0. The vulnerability allows an attacker to include and execute arbitrary files from the server by manipulating the controller parameter in the index.php file.

Simple technical breakdown

The vulnerability exists because the com_smartsite component in Joomla! doesn't properly sanitize user input for the controller parameter. When a user requests a page that uses this component, the index.php file processes the controller parameter. If this parameter contains a path traversal sequence (like ../../), the component can be tricked into including and displaying the content of files that it's not supposed to access. This is often used to read sensitive files like /etc/passwd or configuration files.

Complete code and payload walkthrough

The provided paper does not contain executable code or shellcode. It only provides:

• Software Information: Details about the vulnerable component (com_smartsite), its vendor, and the author of the exploit.
• Exploit URL Structure: A template showing how the exploit is structured:
  http://localhost/[path]/index.php?option=com_smartsite&controller=[LFI]
• Proof of Concept (PoC) URL: A concrete example demonstrating the exploit:
  http://localhost/index.php?option=com_smartsite&controller=../../../../../../../../../../etc/passwd%00

Explanation of the PoC URL:

• http://localhost/index.php: This is the entry point for Joomla! websites.
• ?option=com_smartsite: This parameter tells Joomla! to load the "SmartSite" component.
• &controller=../../../../../../../../../../etc/passwd%00: This is the core of the exploit.
  • ../../../../../../../../../../: This is a path traversal sequence. It tells the server to move up the directory tree multiple times. The number of ../ sequences is chosen to reach the root directory of the server.
  • etc/passwd: This is the target file. On Linux/Unix systems, this file contains user account information.
  • %00: This is a null byte. In older PHP versions, a null byte could terminate a string, effectively cutting off any further processing of the controller parameter. This could prevent the application from appending any default extension or path to the filename, ensuring that only /etc/passwd is included.

Code Fragment/Block -> Practical Purpose Mapping:

• index.php?option=com_smartsite&controller=[LFI] -> Exploit Template: Defines the structure for triggering the vulnerability by targeting the com_smartsite component and injecting malicious input into the controller parameter.
• ../../../../../../../../../../etc/passwd%00 -> LFI Payload: The specific input designed to exploit the vulnerability. It uses path traversal to reach and include the /etc/passwd file, with a null byte to ensure the inclusion is clean.

Shellcode/Payload Bytes: There are no shellcode or payload bytes present in this paper. The exploit's "payload" is the content of the file it successfully includes.

Practical details for offensive operations teams

• Required Access Level: Low. This is a web application vulnerability, typically exploitable by an unauthenticated user with network access to the target web server.
• Lab Preconditions:
  • A vulnerable Joomla! installation.
  • The "SmartSite" component (version 1.0.0 or a similarly vulnerable version) must be installed.
  • A web server environment (e.g., Apache, Nginx) running PHP.
  • Access to the target web application via a browser or an HTTP client.
• Tooling Assumptions:
  • Web Browser: For manual testing and verification.
  • HTTP Proxy/Interception Tool (e.g., Burp Suite, OWASP ZAP): Essential for crafting and modifying HTTP requests, observing responses, and automating the process.
  • Vulnerability Scanner (optional): Can help identify potential LFI vulnerabilities, but manual verification is crucial.
  • Scripting Language (e.g., Python, PHP): For automating the exploitation across multiple targets or for more complex payload delivery if the LFI can be chained with other vulnerabilities.
• Execution Pitfalls:
  • Path Traversal Depth: The number of ../ sequences might need adjustment based on the web server's document root and the location of the index.php file. Too few might not reach the target file; too many might go beyond the root and cause errors.
  • Null Byte Effectiveness: The %00 null byte might not be effective in all PHP versions or configurations. If it fails, the exploit might need to be adapted to work without it, or the target file might need to be specified differently.
  • File Permissions: The web server process must have read permissions for the target file (e.g., /etc/passwd).
  • Web Application Firewall (WAF): WAFs can detect and block path traversal sequences and common LFI payloads. Evasion techniques might be necessary.
  • Error Handling: The target application might have robust error handling that masks the actual vulnerability or prevents sensitive information from being displayed.
  • Target File Availability: The exploit only works if the target file exists and is accessible.
• Telemetry:
  • Web Server Access Logs: Look for requests to index.php with option=com_smartsite and unusual controller parameters containing path traversal sequences.
  • Web Server Error Logs: May reveal attempts to access non-existent files or directories, or permission denied errors, indicating failed LFI attempts.
  • Application Logs: If the Joomla! application or the SmartSite component logs requests or errors, these might provide clues.
  • Network Traffic: Observe HTTP requests and responses. Successful exploitation will show the content of the included file in the HTTP response body.

Where this was used and when

This vulnerability was published in April 2010. It targets a specific Joomla! component. While the exact widespread use in real-world attacks is not detailed in the paper, vulnerabilities of this nature in popular CMS platforms like Joomla! are frequently exploited by attackers. The timeframe suggests it was relevant around 2010 and for a period afterward until the component was patched or updated.

Defensive lessons for modern teams

• Input Validation and Sanitization: Always validate and sanitize all user-supplied input, especially parameters used in file inclusion or path operations. Remove or disallow characters like ../, /, \, and null bytes.
• Least Privilege Principle: Ensure the web server process runs with the minimum necessary privileges. It should not have read access to sensitive system files.
• Secure Configuration: Configure web servers and PHP to prevent directory traversal attacks (e.g., using open_basedir in PHP).
• Regular Patching and Updates: Keep all CMS platforms, extensions, and plugins updated to the latest secure versions. This vulnerability was in a specific version of a component, highlighting the risk of using outdated software.
• Web Application Firewalls (WAFs): Deploy and properly configure WAFs to detect and block common attack patterns, including LFI attempts.
• Security Audits and Code Reviews: Regularly audit custom code and third-party extensions for security vulnerabilities.
• Disable Unused Components: Remove or disable any components that are not actively used to reduce the attack surface.

ASCII visual (if applicable)

This vulnerability is a direct manipulation of HTTP requests to a specific web application endpoint. An ASCII visual would primarily represent the flow of an HTTP request and response.

+-----------------+       +-----------------+       +-----------------+
| Attacker's      | ----> | Web Server      | ----> | Joomla! App     |
| Machine         |       | (e.g., Apache)  |       | (index.php)     |
+-----------------+       +-----------------+       +-----------------+
      |                                                       |
      | HTTP Request                                          | Processes Request
      | (with LFI payload)                                    |
      |                                                       |
      v                                                       v
+-----------------+       +-----------------+       +-----------------+
| Network         | ----> | Joomla!         | ----> | SmartSite Comp. |
| Infrastructure  |       | Component       |       | (vulnerable)    |
+-----------------+       | Loader          |       +-----------------+
                          +-----------------+               |
                                                            | Tries to include file
                                                            | based on 'controller'
                                                            v
                                                      +-----------------+
                                                      | Target File     |
                                                      | (e.g., /etc/passwd)|
                                                      +-----------------+
                                                            |
                                                            | Reads File Content
                                                            v
                                                      +-----------------+
                                                      | HTTP Response   |
                                                      | (with file data)|
                                                      +-----------------+

Source references

• Paper ID: 12428
• Paper Title: Joomla! Component SmartSite 1.0.0 - Local File Inclusion
• Author: AntiSecurity
• Published: 2010-04-27
• Keywords: PHP, webapps
• Paper URL: https://www.exploit-db.com/papers/12428

Original Exploit-DB Content (Verbatim)

===============================================================================================================


  [o] Joomla Component SmartSite Local File Inclusion Vulnerability
 
       Software : com_smartsite
       Vendor   : http://www.smartsite.su/
       Author   : AntiSecurity [ s4va NoGe Vrs-hCk OoN_BoY Paman zxvf ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


===============================================================================================================


  [o] Exploit

       http://localhost/[path]/index.php?option=com_smartsite&controller=[LFI]


  [o] PoC

       http://localhost/index.php?option=com_smartsite&controller=../../../../../../../../../../etc/passwd%00


===============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11


===============================================================================================================


  [o] April 27 2010 - GMT +07:00 Jakarta, Indonesia