Description
A critical PHP object injection vulnerability exists in Joomla CMS versions 1.5.x through 3.4.5. The vulnerability allows remote attackers to inject arbitrary PHP objects into the application through the user agent string, which is then processed by the JInput class during session handling.
Impact
Successful exploitation allows remote code execution on the server. An attacker can execute arbitrary PHP code by leveraging magic methods in loaded classes, potentially gaining full control of the web server.
Technical Details
The vulnerability stems from improper sanitization of the HTTP User-Agent header, which is stored in the session data and later unserialized using unserialize(). This allows an attacker to craft a malicious serialized object that, when unserialized, triggers destructive magic methods.
Proof of Concept
The exploit sends a specially crafted User-Agent header containing a serialized PHP object. When Joomla processes the session, the object is unserialized, triggering the __destruct() method of injected objects.
Solution
Upgrade to Joomla 3.4.6 or later, which patches the object injection vulnerability by replacing unserialize() with json_decode() for session data handling.