In the recent days, a new vulnerability in Joomla has been published (CVE-2017-14596). The vulnerability concerns Joomla installations which have Joomla’s LDAP plugin installed and are using it to authenticate the system’s users. The vulnerability flowing from insufficient input validation in the authentication function of the Joomla LDAP plugin, which allows attackers to inject a specially crafted LDAP query into the LDAP query responsible for validating the entered username and password. By using the wildcard operator (*) in the injected LDAP query and examining the different error messages shown by the application it is possible to enumerate the system’s administrative username and password and consequently take over Joomla and later the machine hosting it.
Figure 1: Login request exploiting the vulnerability.
Mitigating the 0-day with BIG-IP ASM
BIG-IP ASM customers under any supported BIG-IP version are already protected against this 0-day vulnerability, as the exploitation attempt will be detected by an existing LDAP injection attack signature which can be found in signature sets that include the “LDAP Injection” attack type.
Following are ASM logs of blocked attempts to exploit protected Joomla application.
Figure 2: Exploit blocked with Attack Signature (200005005)