Joomify: CVE-2023-23752

Joomla is a free and open-source Content Management System (CMS) that is widely used to build blogging websites. At the time of writing (opens in new tab), the platform ranks 5th, surpassing other vital platforms like Bitrix, Drupal, etc. In Feb 2023, the platform identified a vulnerability that allowed unauthorized users to fetch information from various web endpoints without prior authentication. The vulnerability was identified by Zewei Zhang from NSFOCUS TIANJI Lab and was assigned the severity Medium  and CVE-ID 2023-23752 .

• Primary techniques to exploit a Joomla CMS through CVE 2023-23752
• How medium-level vulnerabilities can lead from information disclosure to complete Remote Code Execution (RCE)
• Protection and mitigation measures

Course Pre-requisites
Understanding the following topics is recommended before starting the course:-

• How Websites Works
• Protocols and Severs
• OWASP Top 10

Connecting to the Machine
We will use a Ubuntu-based machine to demonstrate the room's red and blue team perspective. L et’s start the Lab Machine by pressing the Start Lab Machine button at the top of this task. You may access the VM using the AttackBox or your VPN connection . Please wait 1-2 minutes after the system boots completely to let the auto scripts run successfully.

You can access the vulnerable Joomla application hosted at http://MACHINE_IP for the red teaming exercise.

For the blue team exercise and prevention from the attack, we have installed an AWS OpenSearch SIEM solution that will allow detection of the vulnerability and attack through pre-defined rules.

• IP:  http://MACHINE_IP:5601/  
• Username:    admin
• Password:    admin

Let's begin!