CVE-2024-40744
📋 TL;DR
This vulnerability allows attackers to bypass security restrictions and upload arbitrary files to Joomla websites using the Convert Forms component. Attackers can achieve remote code execution by uploading malicious files like PHP shells. All Joomla sites using vulnerable versions of Convert Forms are affected.
💻 Affected Systems
- Joomla with Convert Forms component
📦 What is this software?
Convert Forms by Convert Forms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, defacement, ransomware deployment, or use as attack platform
Likely Case
Website defacement, backdoor installation, data exfiltration, or credential theft
If Mitigated
Limited impact with proper file upload validation and web application firewall rules
🎯 Exploit Status
CVSS 9.8 indicates critical severity with network access and no privileges required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Convert Forms 4.4.8
Vendor Advisory: https://www.tassos.gr/joomla-extensions/convert-forms
Restart Required: No
Instructions:
1. Log into Joomla admin panel. 2. Navigate to Extensions > Manage > Update. 3. Update Convert Forms to version 4.4.8 or later. 4. Alternatively, download from vendor site and install manually.
🔧 Temporary Workarounds
Disable Convert Forms component
allTemporarily disable the vulnerable component until patching
Navigate to Extensions > Manage > Manage, find Convert Forms, click Disable
Restrict file uploads via .htaccess
linuxBlock execution of uploaded files in upload directories
Add to .htaccess in upload directories: <FilesMatch "\.(php|php5|php7|phtml|phar)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Implement strict file upload validation at web application firewall level
- Monitor upload directories for suspicious files and restrict permissions
🔍 How to Verify
Check if Vulnerable:
Check Convert Forms version in Joomla admin panel under Extensions > Manage > ManageCheck Version:
Check Joomla admin panel or database #__extensions table for Convert Forms versionVerify Fix Applied:
Confirm Convert Forms version is 4.4.8 or higher in component details📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to Convert Forms endpoints
- PHP file execution from upload directories
- Multiple failed upload attempts
Network Indicators:
- POST requests to /index.php?option=com_convertforms with file uploads
- Unusual traffic to upload directories
SIEM Query:
source="web_server" AND (uri="*com_convertforms*" AND method="POST") AND (file_extension="php" OR file_extension="phtml")