CVE-2017-18345
📋 TL;DR
CVE-2017-18345 is an arbitrary file download vulnerability in the Joomanager component for Joomla! that allows unauthenticated attackers to download sensitive files, including the configuration.php file containing database credentials. This affects all Joomla! installations using Joomanager component version 2.0.0 or earlier. Attackers can exploit this to steal database credentials and potentially compromise the entire Joomla! installation.
💻 Affected Systems
- Joomla! with Joomanager component
📦 What is this software?
Joomanager by Joomanager Project
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the Joomla! installation including database takeover, website defacement, data theft, and potential server compromise if database credentials have elevated privileges.
Likely Case
Database credential theft leading to unauthorized database access, data exfiltration, and potential privilege escalation within the Joomla! application.
If Mitigated
Limited impact if database credentials are properly secured with minimal privileges and network access restrictions, though sensitive configuration files may still be exposed.
🎯 Exploit Status
Exploitation requires only a simple HTTP GET request to the vulnerable endpoint. Multiple public exploit scripts are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Joomanager component version after 2.0.0
Vendor Advisory: https://vel.joomla.org/vel-blog/2020-joomanager-2-0-0-other
Restart Required: No
Instructions:
1. Log into Joomla! administrator panel. 2. Navigate to Extensions > Manage > Update. 3. Update Joomanager component to latest version. 4. Alternatively, manually download and install updated component from official Joomla! extensions directory.
🔧 Temporary Workarounds
Remove Joomanager component
allCompletely uninstall the vulnerable Joomanager component if not required
Navigate to Joomla! administrator > Extensions > Manage > Manage > Select Joomanager > Uninstall
Restrict access to vulnerable endpoint
allUse web server rules to block access to the vulnerable URL pattern
For Apache: RewriteRule ^index\.php\?option=com_joomanager.* - [F,L]
For Nginx: location ~* "index\.php\?option=com_joomanager" { return 403; }
🧯 If You Can't Patch
- Immediately remove or disable the Joomanager component from all Joomla! installations
- Implement strict network access controls to limit access to Joomla! administration interfaces and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if Joomanager component is installed and version is 2.0.0 or earlier via Joomla! administrator panel under Extensions > ManageCheck Version:
Check Joomla! administrator panel: Extensions > Manage > Search for 'joomanager'Verify Fix Applied:
Verify Joomanager component version is updated beyond 2.0.0 and test that the vulnerable URL returns an error or is inaccessible📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests containing 'index.php?option=com_joomanager&controller=details&task=download&path='
- Access to configuration.php file from unexpected sources
- Failed database login attempts following file access
Network Indicators:
- Unusual outbound database connections from web server
- Traffic patterns matching exploit payloads to vulnerable endpoint
SIEM Query:
source="web_server_logs" AND uri="*index.php?option=com_joomanager*" AND uri="*task=download*"