Unauthenticated Arbitrary File Upload in YOOtheme Zoo Extension

Executive Summary

This vulnerability allows unauthenticated attackers to upload arbitrary files to a Joomla website running the Zoo extension version before 4.1.64. The flaw occurs because the image element accepts files based on the client-supplied Content-Type header, which can be manipulated to bypass restrictions and upload malicious files.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability allows unauthenticated arbitrary file uploads in Zoo extension versions below 4.1.64. To detect it, check if the Zoo extension version is outdated by inspecting the Joomla admin panel or running SQL queries on the Joomla database to find the installed version. Look for unexpected files in web-accessible directories, particularly those with image extensions but containing executable code.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to upload malicious files like web shells, which could lead to full system compromise, data theft, or unauthorized access to the website. Since no authentication is required, any unpatched system is at high risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face fines, legal liabilities, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Zoo extension to version 4.1.64 or later to address the unauthenticated arbitrary file upload vulnerability.

Useful 0 Not Useful 0