Unauthenticated File Upload in Joomla Custom Tables

Executive Summary

This is an unauthenticated arbitrary file upload vulnerability in the Joomla Custom Tables extension version 3.7.8 or earlier. An attacker can upload a malicious file with a controlled extension to the web-accessible tmp directory of any Joomla site with a public Custom Tables submission form. The server responds with the stored file path, allowing the attacker to access the uploaded file. By default, the file is served as static content, enabling hosting of attacker-controlled content like phishing or malware pages under the victim's domain.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized files in Joomla's tmp directory. Look for recently uploaded files with unexpected extensions. Inspect server logs for POST requests to Custom Tables submission endpoints. Use commands like 'find /path/to/joomla/tmp -type f -mtime -1' to find recently modified files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to upload malicious files to your Joomla site, potentially hosting phishing pages or malware under your domain. This could damage your reputation, lead to legal issues, or allow further attacks against your users. The vulnerability requires no authentication, making it easier for attackers to exploit.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file uploads, potentially exposing sensitive user data or violating data protection requirements under GDPR or HIPAA. If attacker-controlled content is hosted on your site, it may result in breaches of confidentiality or integrity, triggering compliance violations and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Custom Tables extension to version 3.7.8 or later. Disable public submission forms if not needed. Restrict write permissions to the tmp directory. Monitor for suspicious file uploads or unusual server activity.

Useful 0 Not Useful 0