Authenticated arbitrary file upload in JCE com_jce profile import (profiles.import)

Skrevet den af i Joomla Content Editor (JCE)

The profiles.import task validated only a CSRF token with no core.manage check, so any authenticated user could call it. The handler ran only JFile::makeSafe() on the upload no extension/size check and wrote it via JFile::upload(…, $allow_unsafe = true), disabling Joomla’s unsafe-filetype filter. A low-privileged user could thus upload a .php file to tmp_path (potential RCE). The XML parse also lacked a key whitelist (mass assignment) and entity-loader guard (XXE hardening).

This vulnerability affects the following application versions:

  • Joomla Content Editor (JCE) 2.9.23
  • Joomla Content Editor (JCE) 2.9.24
  • Joomla Content Editor (JCE) 2.9.25
  • Joomla Content Editor (JCE) 2.9.26
  • Joomla Content Editor (JCE) 2.9.27
  • Joomla Content Editor (JCE) 2.9.28
  • Joomla Content Editor (JCE) 2.9.29
  • Joomla Content Editor (JCE) 2.9.30
  • Joomla Content Editor (JCE) 2.9.31
  • Joomla Content Editor (JCE) 2.9.32
  • Joomla Content Editor (JCE) 2.9.33
  • Joomla Content Editor (JCE) 2.9.34
  • Joomla Content Editor (JCE) 2.9.35
  • Joomla Content Editor (JCE) 2.9.36
  • Joomla Content Editor (JCE) 2.9.37
  • Joomla Content Editor (JCE) 2.9.38
  • Joomla Content Editor (JCE) 2.9.39
  • Joomla Content Editor (JCE) 2.9.40
  • Joomla Content Editor (JCE) 2.9.41
  • Joomla Content Editor (JCE) 2.9.50
  • Joomla Content Editor (JCE) 2.9.51
  • Joomla Content Editor (JCE) 2.9.52
  • Joomla Content Editor (JCE) 2.9.53
  • Joomla Content Editor (JCE) 2.9.54
  • Joomla Content Editor (JCE) 2.9.55
  • Joomla Content Editor (JCE) 2.9.56
  • Joomla Content Editor (JCE) 2.9.57
  • Joomla Content Editor (JCE) 2.9.58
  • Joomla Content Editor (JCE) 2.9.59
  • Joomla Content Editor (JCE) 2.9.60
  • Joomla Content Editor (JCE) 2.9.61
  • Joomla Content Editor (JCE) 2.9.62
  • Joomla Content Editor (JCE) 2.9.63
  • Joomla Content Editor (JCE) 2.9.70
  • Joomla Content Editor (JCE) 2.9.71
  • Joomla Content Editor (JCE) 2.9.72
  • Joomla Content Editor (JCE) 2.9.73
  • Joomla Content Editor (JCE) 2.9.74
  • Joomla Content Editor (JCE) 2.9.75
  • Joomla Content Editor (JCE) 2.9.76
  • Joomla Content Editor (JCE) 2.9.77
  • Joomla Content Editor (JCE) 2.9.78
  • Joomla Content Editor (JCE) 2.9.79
  • Joomla Content Editor (JCE) 2.9.80
  • Joomla Content Editor (JCE) 2.9.81
  • Joomla Content Editor (JCE) 2.9.82
  • Joomla Content Editor (JCE) 2.9.83
  • Joomla Content Editor (JCE) 2.9.84
  • Joomla Content Editor (JCE) 2.9.85
  • Joomla Content Editor (JCE) 2.9.86
  • Joomla Content Editor (JCE) 2.9.87
  • Joomla Content Editor (JCE) 2.9.88
  • Joomla Content Editor (JCE) 2.9.88.1
  • Joomla Content Editor (JCE) 2.9.89
  • Joomla Content Editor (JCE) 2.9.90
  • Joomla Content Editor (JCE) 2.9.91
  • Joomla Content Editor (JCE) 2.9.92
  • Joomla Content Editor (JCE) 2.9.93
  • Joomla Content Editor (JCE) 2.9.94
  • Joomla Content Editor (JCE) 2.9.95
  • Joomla Content Editor (JCE) 2.9.96
  • Joomla Content Editor (JCE) 2.9.97
  • Joomla Content Editor (JCE) 2.9.98
  • Joomla Content Editor (JCE) 2.9.99
  • Joomla Content Editor (JCE) 2.9.99.1
  • Joomla Content Editor (JCE) 2.9.99.2
  • Joomla Content Editor (JCE) 2.9.99.3
  • Joomla Content Editor (JCE) 2.9.99.4
  • Joomla Content Editor (JCE) 2.9.99.5