Une vieille vulnérabilité critique de 8 ans #Joomla

In Cyber-sécurité
Déroulez ici

Voici une information intéressante: une faille critique de 8 ans découverte sur Joomla. Mais peut-être faudrait-il davantage parler davantage de l’omerta des cyber-criminels.

Cela signifie que pendant 8 ans des cyber-criminels ont pu profiter de cette faille pour collecter les identifiants et mots de passe, y compris des administrateurs.

[aesop_quote type=”block” background=”#282828″ text=”#ffffff” align=”left” size=”1″ quote=”For the last eight years a critical vulnerability has lurked within the code of the Joomla CMS which could have allowed malicious hackers to steal every user’s login credentials – including those belonging to administrators.” cite=”hot for security blog” parallax=”off” direction=”left” revealfx=”off”]

Pour précision, cette vulnérabilité concernait le plugin LDAP et elle est maintenant corrigée. Elle se matérialise sous la forme d’une injection SQL rapportée dans ce blog:

Joomla! 3.7.5 – Takeover in 20 Seconds with LDAP Injection

With over 84 million downloads, Joomla! is one of the most popular content management systems in the World Wide Web. It powers about 3.3% of all websites’ content and articles. Our code analysis solution RIPS detected a previously unknown LDAP injection vulnerability in the login controller.

dont voici une démonstration:

et d’autres articles en relation avec cette faille:

Joomla patches eight-year-old critical CMS bug | ZDNet

Joomla has patched a critical bug which could be used to steal account information and fully compromise website domains. This week, the content management system (CMS) provider issued a security advisory detailing the flaw, which is found in the LDAP authentication plugin. Lightweight Directory Access Protocol ( LDAP) is used by Joomla to access directories over TCP/IP.

Joomla 3.8 fixes serious LDAP authentication issue, update now

Version 3.8 of Joomla, the world’s second-most popular website content management system (CMS), is out. The update includes fixes for two security issues including a very serious flaw in Joomla’s LDAP Authentication Plugin. Although the CMS’s popularity is a distant second behind the juggernaut that is WordPress, it is running on over 3% of the world’s websites today (that’s tens of millions of sites).

et encore dans cet article : For eight years, hackers have been able to exploit this password-stealing flaw in Joomla

La newsletter