Slashdot Mirror
Attackers Can Hijack Joomla Sites Via User-Agent Strings (softpedia.com)
An anonymous reader writes: Joomla just issued a emergency security patch after Sucuri observed a large number of attacks on Joomla sites using malicious user-agent strings. Attackers were adding malicious code to custom-made user-agent strings, which were not sanitized and stored in the database. These allowed attackers to trigger remote code on the site and grant them a backdoor into targeted websites. Even if Joomla doesn't care about older versions, the bug was so critical that it issued security patches even for EOL versions going back to 1.5.x.
I've been seeing really strange agent strings for a few weeks in my web server log files. I was wondering what the target was.
It's been 15 years since the explosive growth of the Internet started, dammit. Any "programmer" in this day and age who doesn't sanitize inputs for absolutely every parameter from an service facing the internet should be barred from using a compiler permanently.
Seriously, how can this still be possible?? Don't developers ever learn? Use / develop a secure database driver and let ALL your database queries go though that driver. And when I say ALL, I actually mean ALL!!! We've had SQL injections 20 years ago. There is no excuse to have your application vulnerable for this ancient shit! Really.
I know that my rant tells nothing new, but as a security professional, this shit is really starting to annoy me. I see this shit every week. And because of developers not being able to write secure code, companies get hacked, personal information gets stolen, governments act tough and come up with all sorts of security theater bullshit which results in my privacy getting invaded. So, yes, incompetent developers fucking their shit affects me personally! I really hate incompetent developers...
It doesn't have to be like this. All we need to do is make sure we keep talking.
Really, this is old, well known, easy to avoid. People that make mistakes like this have no business programing. The real problem is very likely though that management hired the cheapest people it could get.
It's an open source project. There's no hiring people involved. Read up before you comment.
Parameterized queries can certainly help reduce injections, and they should be used.
Also, if the quantity field is supposed to be in the range 1-50, don't accept quantity = "1 ;`exec rm -rf /`"
That's obviously an attack and nothing good is going to come from that transaction, so terminally cleanly but quickly. You don't need to store an order for that number of tickets.
A couple of significant security issues have been related to later statistical analysis of the data. The real-time application handled it fine by parameterizing it or escaping it properly, but later summary statistics were generated by a tool that was exploited by specially-crafted strings. Why allow that? You know the input is crap, so why knowingly send crap to other libraries or systems? There's no need to "correctly" send hack attempts down the line. If it's supposed to be a hostname, but it contains backticks and semicolons, stop it right there. No need to pass that to getbyhostbyname() or anywhere else, other than your security monitoring systems.
Who said anything about databases?
You need to sanitize the inputs before you:
I don't care about your fucking database and your fucking parametrized statements, you still need to verify that your inputs are sane.
"Go to CNN [for a] spell-checked, fact-checked summary" -- CmdrTaco