1. OVERVIEW The Joomla! web application was vulnerable to Cross Site Scripting vulnerability. 2. PRODUCT DESCRIPTION Joomla is a free and open source content management system (CMS) for publishing content on the World Wide Web and ntranets. It comprises a model–view–controller (MVC) Web application framework that can also be used independently. Joomla is written in PHP, uses object-oriented programming (OOP) techniques and software design patterns, stores data in a MySQL database, and includes features such as page caching, RSS feeds, printable versions of pages, news flashes, blogs, polls, search, and support for language internationalization. 3. VULNERABILITY DESCRIPTION Some URLs in Joomla! do not properly escape encoded user inputs that lead to cross site scripting vulnerability. For more information about this kind of vulnerability, see OWASP Top 10 - A2, WASC-8 and CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). 4. VERSIONS AFFECTED Joomla! 1.5.20 and lower 5. PROOF-OF-CONCEPT/EXPLOIT http://yehg.net/lab/pr0js/training/view/misc/joomla-1.5.20_encoded-xss/ 6. IMPACT Attackers can compromise currently logged-in user/administrator session and impersonate arbitrary user actions available under /administrator/ functions. 7. SOLUTION Upgrade to Joomla! 1.5.21 8. VENDOR Joomla! Developer Team http://www.joomla.org 9. CREDIT This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar. 10. DISCLOSURE TIME-LINE 2010-10-04: vulnerability discovered 2010-10-06: notified vendor 2010-10-09: vendor released fix 2010-10-09: vulnerability disclosed 11. REFERENCES Vendor Advisory URL: http://developer.joomla.org/security/news/9-security/10-core-security/322-20101001-core-xss-vulnerabilities.html Original Advisory URL: http://yehg.net/lab/pr0js/advisories/joomla/core/[joomla_1.5.20]_cross_site_scripting(XSS) XSS FAQ: http://www.cgisecurity.com/xss-faq.html OWASP Top 10: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project CWE-79: http://cwe.mitre.org/data/definitions/79.html --------------------------------- Best regards, YGN Ethical Hacker Group