Over 100 Bugs in a Row: Security Analysis of the Top-Rated Joomla Extensions
Authors:
Marcus Niemietz,
Mario Korth,
Christian Mainka,
Juraj Somorovsky
Abstract:
Nearly every second website is using a Content Management System (CMS) such as WordPress, Drupal, and Joomla. These systems help to create and modify digital data, typically within a collaborative environment. One common feature is to enrich their functionality by using extensions. Popular extensions allow developers to easily include payment gateways, backup tools, and social media components.…
▽ More
Nearly every second website is using a Content Management System (CMS) such as WordPress, Drupal, and Joomla. These systems help to create and modify digital data, typically within a collaborative environment. One common feature is to enrich their functionality by using extensions. Popular extensions allow developers to easily include payment gateways, backup tools, and social media components.
Due to the extended functionality, it is not surprising that such an expansion of complexity implies a bigger attack surface. In contrast to CMS core systems, extensions are usually not considered during public security audits. However, a Cross-Site Scripting (XSS) or SQL injection (SQLi) attack within an activated extension has the same effect on the security of a CMS as the same issue within the core itself. Therefore, vulnerabilities within extensions are a very attractive tool for malicious parties.
We study the security of CMS extensions using the example Joomla; one of the most popular systems. We discovered that nearly every second installation of such a system also includes Joomla's official top-10 rated extensions as a per se requirement. Moreover, we have detected that every single extension of the official top-10 rated extensions is vulnerable to XSS and 30% of them against SQLi. We show that our findings are not only relevant to Joomla; two of the analyzed extensions are available within systems like WordPress or Drupal, and introduce the same vulnerabilities. Finally, we pinpoint mitigation strategies that can be realized within extensions to achieve the same security level as the core CMS.
△ Less
Submitted 5 February, 2021;
originally announced February 2021.
Owning Your Home Network: Router Security Revisited
Authors:
Marcus Niemietz,
Joerg Schwenk
Abstract:
In this paper we investigate the Web interfaces of several DSL home routers that can be used to manage their settings via a Web browser. Our goal is to change these settings by using primary XSS and UI redressing attacks. This study evaluates routers from 10 different manufacturers (TP-Link, Netgear, Huawei, D-Link, Linksys, LogiLink, Belkin, Buffalo, Fritz!Box, and Asus). We were able to circumve…
▽ More
In this paper we investigate the Web interfaces of several DSL home routers that can be used to manage their settings via a Web browser. Our goal is to change these settings by using primary XSS and UI redressing attacks. This study evaluates routers from 10 different manufacturers (TP-Link, Netgear, Huawei, D-Link, Linksys, LogiLink, Belkin, Buffalo, Fritz!Box, and Asus). We were able to circumvent the security of all of them. To demonstrate how all devices are able to be attacked, we show how to do fast fingerprinting attacks. Furthermore, we provide countermeasures to make administration interfaces and therefore the use of routers more secure.
△ Less
Submitted 12 June, 2015;
originally announced June 2015.
