Joomla 3.4.6, how an ordinary browser header took over the server
This is one of those flaws people call "legendary". In December 2015 it turned out that a Joomla site could be taken over without logging in, and the weapon was an ordinary header that every browser sends with every request.
What happened
Joomla stored information about the visitor's browser in the session, including the User-Agent header. The flaw CVE-2015-8562 allowed PHP code to be smuggled into that header, which then ran, classic remote code execution (RCE). No account, no password.
It affected all versions from 1.5 up to 3.4.5. Worse, the flaw was used in attacks even before the patch came out, the Joomla team released a fix (version 3.4.6) as an emergency.
Why it still matters
This story shows two things. First, an attack can come from a place nobody thinks about, even a browser header. Second: old Joomla versions still circulate on the web and are still scanned for exactly this flaw.
What to do
- Check which Joomla version you run. If it is the 3.4 branch or older, you have a serious problem and need to act.
- Update the Joomla core continuously; critical patches come out as emergencies for a reason.
- Make a backup before updating.
Joomla can be secure, provided someone looks after it. As part of our care service we update the core and extensions before a flaw becomes a headline. Get in touch.
Source: NVD, CVE-2015-8562.