Path Traversal in K2 Joomla Extension

Executive Summary

This vulnerability exists in the K2 frontend article-save handler, which accepts a POST field named `attachment[N][existing]`. This field is concatenated with the server path `JPATH_SITE/` and passed to the file copy function `JFile::copy()`. The path cleaning function `JPath::clean` does not remove directory traversal sequences like `..`, and there is no allow-list restricting source file paths.

As a result, an Author-level user can exploit this by copying sensitive files such as `configuration.php` or any other file readable by the web user (including system files like `../../../etc/passwd`) into the `/media/k2/attachments/` directory. These files can then be accessed and downloaded via the K2 attachment-download endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with Author-level access to read and download sensitive files from the server that should normally be protected.

• Disclosure of sensitive configuration files such as `configuration.php` which may contain database credentials and other secrets.
• Exposure of system files like `/etc/passwd` that could aid in further attacks.
• Potential compromise of the confidentiality and integrity of the web application and server environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the K2 frontend article-save handler accepting a crafted POST field that allows an Author to copy arbitrary readable files into the /media/k2/attachments/ directory, which can then be accessed via the attachment-download endpoint.

To detect exploitation attempts on your system or network, you can monitor HTTP POST requests to the K2 article-save handler for suspicious parameters like attachment[N][existing] containing path traversal sequences (e.g., ../).

Suggested commands to detect such activity include:

• Using web server logs, search for POST requests with 'attachment' parameters containing '..' sequences: grep -i 'attachment.*\.\.\/' /var/log/apache2/access.log
• Use network monitoring tools like tcpdump or Wireshark to filter HTTP POST traffic to the K2 article-save endpoint and inspect payloads for suspicious path traversal patterns.
• On the server, check the /media/k2/attachments/ directory for unexpected files such as configuration.php or passwd that should not be present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting the ability of Authors to upload or save attachments until a patch is applied.

Additionally, you should monitor and restrict access to the /media/k2/attachments/ directory to prevent unauthorized file downloads.

Applying any available security updates or patches from the K2 or JoomlaWorks developers as soon as possible is critical.

As a temporary workaround, consider implementing web application firewall (WAF) rules to block POST requests containing suspicious path traversal patterns in the attachment[N][existing] parameter.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an Author to copy sensitive files readable by the web user, such as configuration files or system files like /etc/passwd, into a publicly accessible location and then retrieve their contents. This exposure of sensitive information could lead to unauthorized access to personal or protected data.

Such unauthorized disclosure of sensitive data can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information from unauthorized access or disclosure.

Useful 0 Not Useful 0