Information Disclosure in Joomla com_booking Component

Executive Summary

CVE-2023-54357 is an information disclosure vulnerability in the Joomla com_booking component version 2.4.9. It allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller.

Attackers can send specially crafted GET requests to the index.php endpoint with parameters option=com_booking, controller=customer, task=getUserData, and an id parameter. By brute forcing the id parameter, they can retrieve sensitive user information such as names, usernames, and email addresses without needing to authenticate.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Joomla com_booking component 2.4.9 allows unauthenticated attackers to enumerate user accounts and retrieve sensitive personal information such as names, usernames, and email addresses. This exposure of personal data could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of personally identifiable information (PII) and mandate strict controls on unauthorized data access.

By enabling attackers to collect user data without authentication, the vulnerability increases the risk of privacy breaches, potentially resulting in violations of regulatory requirements for data confidentiality, user consent, and breach notification.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts as it allows attackers to gather valid user account information including names, usernames, and email addresses without authentication.

• Attackers can use the enumerated data for targeted phishing campaigns.
• The information can facilitate brute-force password attacks against user accounts.
• Exposure of user data can lead to privacy violations and loss of user trust.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted GET requests to the Joomla instance targeting the vulnerable com_booking component. Specifically, you can test the endpoint index.php with parameters option=com_booking, controller=customer, task=getUserData, and varying id values to check if user information such as names, usernames, and email addresses are returned without authentication.

A simple detection method is to use curl or similar HTTP clients to send requests incrementing the id parameter and observe if user data is disclosed.

• curl "http://<target>/index.php?option=com_booking&controller=customer&task=getUserData&id=1"
• curl "http://<target>/index.php?option=com_booking&controller=customer&task=getUserData&id=2"

By automating these requests with a script that increments the id parameter, you can enumerate user accounts if the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should restrict access to the vulnerable getUserData function in the com_booking component to authenticated and authorized users only.

If possible, update the com_booking component to a version that patches this vulnerability or apply any available security patches from the vendor.

As a temporary measure, you can implement web application firewall (WAF) rules to block or rate-limit requests to the endpoint index.php with parameters option=com_booking, controller=customer, task=getUserData, and id.

Additionally, monitor logs for suspicious GET requests targeting this endpoint to detect potential exploitation attempts.

Useful 0 Not Useful 0