CVE-2024-5735
📋 TL;DR
A Full Path Disclosure vulnerability in the AdmirorFrames Joomla! extension allows unauthenticated attackers to retrieve the web root folder location. This affects AdmirorFrames versions before 5.0. The exposed path information can aid attackers in further exploitation attempts.
💻 Affected Systems
- AdmirorFrames Joomla! Extension
📦 What is this software?
Admirorframes by Admiror Design Studio
⚠️ Risk & Real-World Impact
Worst Case
Attackers combine path disclosure with other vulnerabilities to achieve remote code execution or sensitive data exposure.
Likely Case
Attackers use the path information to map the server structure and plan targeted attacks against the Joomla! installation.
If Mitigated
Limited to information disclosure that doesn't directly compromise data or system integrity.
🎯 Exploit Status
Simple HTTP request to afHelper.php script triggers the disclosure
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0
Vendor Advisory: https://github.com/vasiljevski/admirorframes/issues/3
Restart Required: No
Instructions:
1. Update AdmirorFrames extension to version 5.0 or later. 2. In Joomla! admin panel, go to Extensions > Manage > Update. 3. Check for AdmirorFrames update or manually install version 5.0+.
🔧 Temporary Workarounds
Disable AdmirorFrames Extension
allTemporarily disable the vulnerable extension until patching is possible
Restrict Access to afHelper.php
linuxBlock direct access to the vulnerable script via web server configuration
# Apache: <Files "afHelper.php"> Require all denied </Files>
# Nginx: location ~ /afHelper\.php$ { deny all; }
🧯 If You Can't Patch
- Implement WAF rules to block requests to afHelper.php
- Monitor logs for path disclosure attempts and unusual access patterns
🔍 How to Verify
Check if Vulnerable:
Access /plugins/content/admirorframes/afHelper.php in browser - if it returns full server path, system is vulnerableCheck Version:
Check Joomla! extension manager for AdmirorFrames versionVerify Fix Applied:
After update, access afHelper.php should return error or no path disclosure📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /plugins/content/admirorframes/afHelper.php
- Unusual error messages containing full server paths
Network Indicators:
- GET requests to afHelper.php from external IPs
SIEM Query:
source="web_server" AND uri="/plugins/content/admirorframes/afHelper.php"🔗 References
- https://cert.pl/en/posts/2024/06/CVE-2024-5735/
- https://cert.pl/posts/2024/06/CVE-2024-5735/
- https://github.com/afine-com/CVE-2024-5735
- https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5735
- https://github.com/vasiljevski/admirorframes/issues/3
- https://cert.pl/en/posts/2024/06/CVE-2024-5735/
- https://cert.pl/posts/2024/06/CVE-2024-5735/
- https://github.com/afine-com/CVE-2024-5735
- https://github.com/sectroyer/CVEs/tree/main/CVE-2024-5735
- https://github.com/vasiljevski/admirorframes/issues/3
