One Day SecOne Day Sec

Joomla 3.4.4-3.6.3 Account Creation & Privilege Escalation Test Record

Onedaysec
4 min read
0 views
docx image 1770014876558 0 ea540a4fa6

0x00 Introduction

---

Vulnerabilities Involved:

  • CVE-2016-8869
  • CVE-2016-8870

Using the above vulnerabilities, an attacker can register privileged users

POC:

https://github.com/XiphosResearch/exploits/tree/master/Joomraa

https://www.exploit-db.com/exploits/40637/?rss

Analysis Articles:

http://paper.seebug.org/88/

http://paper.seebug.org/86/

Note:

Content in 0x01 and 0x02 is excerpted from the analysis articles

http://paper.seebug.org/88/

http://paper.seebug.org/86/

0x01 CVE-2016-8870

---

Vulnerability Impact

User creation still possible when website registration is closed

Affected Versions

3.4.4 to 3.6.3

Vulnerability Principle

There are two methods for user registration:

UsersControllerRegistration::register() located in components/com_users/controllers/registration.php

UsersControllerUser::register() located in components/com_users/controllers/user.php

Compared to UsersControllerRegistration::register(), the implementation of UsersControllerUser::register() lacks the following lines of code:

// If registration is disabled - Redirect to login page.
if (JComponentHelper::getParams('com_users')->get('allowUserRegistration') == 0)
{
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false));

return false;
}

These lines of code check whether registration is allowed, meaning that if we can use the UsersControllerUser::register() method to register, we can bypass this check.

Patch Analysis

The official fix removed the UsersControllerUser::register() method.

Note:

The above is quoted from http://paper.seebug.org/86/

0x02 CVE-2016-8869

---

Vulnerability Impact

Privileged users can still be created even when site registration is disabled.

Affected Versions

3.4.4 to 3.6.3

Vulnerability Principle

Construct special request packets to assign values to groups representing permissions

Patch Analysis

Official removed the UsersControllerUser::register() method

Note:

The above is quoted from http://paper.seebug.org/88/

0x03 Actual Testing

---

Test System:

Win8.1 x86

1. Set up PHP environment

Download and install phpStudy

After installation as shown

1. Set up PHP environment — technical illustration 1

Configure directory as: C:\WWW

2. Configure Joomla Environment

Download Joomla version 3.6.3 from the following address:

https://github.com/joomla/joomla-cms/releases/download/3.6.3/Joomla_3.6.3-Stable-Full_Package.tar.gz

After extraction, place the files under C:\WWW

Access http://localhost to enter the installation page

As shown in the figure

2. Configure Joomla Environment — technical illustration 2

Select MySQL as the database type, as shown in the figure

2. Configure Joomla Environment — technical illustration 3

Log in to the database, default password is root

As shown in the figure

2. Configure Joomla Environment — technical illustration 4

Wait for the installation to complete

3. Web login, test

Environment configuration successful, as shown in the figure

3. Web login, test — technical illustration 5

4. PoC Testing

PoC Address:

https://github.com/XiphosResearch/exploits/tree/master/Joomraa

Parameters are as follows:

joomraa.py -u hacker -p password -e [email protected] http://192.168.1.111

As shown below, it prompts to log in to the email to view the activation email, so the email parameter needs to be filled with a real email address

4. PoC Testing — technical illustration 6

At this point, check the Joomla backend and find that the user has been added successfully, but the status is unactivated, as shown in the figure

4. PoC Testing — technical illustration 7

5. Configure Joomla to enable the function of sending activation emails

Select Global Configuration-Global-Server

As shown in the figure

5. Configure Joomla to enable the function of sending activation emails — technical illustration 8

Set email parameters

Note:

The email account needs to have SMTP function enabled

Select Send Test Mail to verify the email, as shown

5. Configure Joomla to enable the function of sending activation emails — technical illustration 9

As shown, the verification email is successfully received

5. Configure Joomla to enable the function of sending activation emails — technical illustration 10

6. Test the POC again

Successfully received the activation email, as shown

6. Test the POC again — technical illustration 11

An error occurs after clicking the link, as shown

6. Test the POC again — technical illustration 12

Check the Joomla source code, location as follows:

https://github.com/joomla/joomla-cms/blob/staging/components/com_users/controllers/registration.php

Found the cause of the issue: If user registration or account activation is disabled, throw a 403.

As shown below

6. Test the POC again — technical illustration 13

7. Enable User Registration Function

Select Global Configuration-Users-User Options, click to allow user registration, as shown in the figure

7. Enable User Registration Function — technical illustration 14

Note:

Since Joomla 3.4, the user registration function is disabled by default

8. Final Test

After enabling the user registration function, click the activation email again to successfully activate the account

As shown in the figure

8. Final Test — technical illustration 15

The backend shows user activation, as shown in the figure

8. Final Test — technical illustration 16

9. Draw the Final Conclusion

Using this vulnerability, privileged users can be created even when user registration is disabled in the backend, but their status remains inactive

Only after the email sending function is enabled in the backend can the attacker's email receive the activation email

Only when the user registration function is enabled in the website backend can the activation code take effect, allowing users to be activated.

Inactive users cannot be used for login.

For Joomla versions higher than 3.4, the user registration function is disabled by default.

After upgrading Joomla to 3.6.4, the test POC shows a successful attack, but no users are added in the website backend, and no activation emails are sent, indicating successful defense.

In summary, for an attacker to gain administrator privileges in the website backend, the following conditions must be met simultaneously:

  • Joomla version is 3.4.4 to 3.6.3.
  • The email sending function is enabled in the website backend.
  • The user registration function is enabled in the website backend.

0x04 Remarks

---

Thanks to DM for the assistance.

This article is only a test record.

Based on the POC, a Python script was developed to check whether a website has the registration function enabled. The address is as follows:

An open-source project

Can be used to simply determine whether a website supports user registration.

This is a reminder to website administrators to upgrade Joomla as soon as possible. If the Joomla version is too low and features such as email sending and user registration are enabled, it is highly vulnerable to attacks.

Related Questions & Answers

How can website administrators determine if their Joomla site is vulnerable and what immediate steps should they take?

Administrators should first check if their Joomla version is between 3.4.4 and 3.6.3. They can also run a Python script (linked in the article) to test if user registration is enabled. The most critical step is to upgrade to Joomla 3.6.4 or later, which removes the vulnerable code. Additionally, ensure that user registration is disabled if not needed, and avoid enabling email SMTP unless required, as these settings raise the attack surface. The full test record is available in the [Joomla 3.4.4-3.6.3 Account Creation & Privilege Escalation Test Record](/news/joomla-3-4-4-3-6-3-account-creation-privilege-escalation-test-record).

What was the official patch for these vulnerabilities, and how does it prevent the exploit?

The official patch removed the vulnerable `UsersControllerUser::register()` method entirely. By eliminating this alternative registration path, attackers can no longer bypass the registration-disabled check or assign privileged groups via that controller. After upgrading to Joomla 3.6.4, the test POC shows no users are added and no activation emails are sent, indicating successful defense. For more on privilege escalation patterns, see related analysis on [AlwaysInstallElevated](/news/test-analysis-of-privilege-escalation-using-alwaysinstallelevated) and [RID hijacking](/news/penetration-techniques-rid-hijacking-of-windows-accounts).

What three conditions must be simultaneously met for an attacker to gain full administrator access via these vulnerabilities?

The attacker requires: (1) Joomla version between 3.4.4 and 3.6.3, (2) the email sending function enabled in the backend (with SMTP configured), and (3) user registration enabled in the backend. Only when all three are true can the attacker create and activate a privileged account. The test record shows that upgrading to 3.6.4 effectively blocks the exploit, and if either email or registration is off, the account never becomes active.

Why might a successful exploit using these vulnerabilities still result in an inactive or unusable account?

Even after successfully creating a privileged user, the account remains in an ‘unactivated’ state. Activation requires the attacker to click a link sent via email, which only works if both the email sending function and user registration are enabled in the Joomla backend. Without both, the account cannot be activated or used to log in, as demonstrated in the [Joomla 3.4.4-3.6.3 Account Creation & Privilege Escalation Test Record](/news/joomla-3-4-4-3-6-3-account-creation-privilege-escalation-test-record).

What are the two vulnerabilities (CVE-2016-8870 and CVE-2016-8869) in Joomla 3.4.4–3.6.3, and how do they work together?

CVE-2016-8870 allows an attacker to create a user account even when the website’s registration is disabled by using the `UsersControllerUser::register()` method, which lacks the registration-disabled check present in the standard `UsersControllerRegistration::register()` method. CVE-2016-8869 enables the attacker to assign privileged groups (like Super Users) to that new account. Combined, they allow registering a privileged user without needing the site’s registration to be enabled, as detailed in the [Joomla 3.4.4-3.6.3 Account Creation & Privilege Escalation Test Record](/news/joomla-3-4-4-3-6-3-account-creation-privilege-escalation-test-record).

Continue Reading