Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Joomla Patches Zero-Day Exploited in the Wild

Joomla released updates and hotfixes on Monday to patch a critical remote code execution vulnerability that has been exploited in the wild.

Joomla released updates and hotfixes on Monday to patch a critical remote code execution vulnerability that has been exploited in the wild.

According to the developers of the popular content management system (CMS), the flaw, caused by the lack of proper filtering when saving browser session values into the database, affects Joomla 1.5.0 through 3.4.5. The security hole has been patched with the release of Joomla 3.4.6 and hotfixes for versions 2.5 and 1.5, both of which have reached end of life (EOL).

Web security company Sucuri reported seeing attacks exploiting this vulnerability starting with December 12, two days before Joomla released patches.

“The attackers are doing an object injection via the HTTP user agent that leads to a full remote command execution,” explained Daniel Cid, founder and CTO of Sucuri.

On December 12 and 13, the security firm spotted hundreds of exploitation attempts coming from three IP addresses: 74.3.170.33, 146.0.72.83 and 194.28.174.106.

“Today (Dec 14th), the wave of attacks is even bigger, with basically every site and honeypot we have being attacked. That means that probably every other Joomla site out there is being targeted as well,” Cid reported.

The security firm advises Joomla users to check their logs for requests coming from the aforementioned IP addresses. Users can determine if their websites have been compromised by searching the logs for “JDatabaseDriverMysqli” or “O:” in the User Agent.

Joomla is often targeted by malicious actors. In October, cybercriminals started exploiting a SQL injection vulnerability just hours after its details were disclosed. At the time, Sucuri detected attack attempts against all the websites on its network, many of which came from the Tor anonymity network.

Advertisement. Scroll to continue reading.

Related Reading: Security Flaws Patched in Joomla, Drupal

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.

Register

People on the Move

DARPA veteran Dan Kaufman has joined Badge as SVP, AI and Cybersecurity.

Kelly Shortridge has been promoted to VP of Security Products at Fastly.

After the passing of Amit Yoran, Tenable has appointed Steve Vintz and Mark Thurmond as co-CEOs.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.