Attack Chain

1. Discovery: An unauthenticated attacker identifies a public-facing Joomla instance running the NextGen Editor component.
2. Vulnerability Identification: The attacker determines that the installed NextGen Editor component is version 2.1.0, which is known to be vulnerable to CVE-2017-20252.
3. Payload Crafting: The attacker constructs a malicious HTTP GET request targeting index.php with the specific parameters option=com_nge&view=config.
4. SQL Injection: The attacker injects malicious SQL syntax (e.g., ' OR 1=1 -- -, UNION SELECT) into the plname parameter within the crafted GET request.
5. Server-Side Execution: The vulnerable NextGen Editor component processes the request without properly sanitizing the plname parameter, leading to the execution of the injected SQL commands on the backend database.
6. Information Disclosure: The executed SQL commands return sensitive database information (such as user credentials, configuration data, or other proprietary information) within the HTTP response to the attacker.
7. Data Exfiltration: The attacker parses the HTTP response to extract the sensitive database information, achieving their objective of data exfiltration.

Impact

Successful exploitation of CVE-2017-20252 grants unauthenticated attackers the ability to extract sensitive database information from the affected Joomla application. This can lead to severe consequences including data breaches involving customer data, intellectual property, or internal configuration details. The disclosure of such information can result in significant financial losses, reputational damage, regulatory fines, and compromise of user accounts which can be used for further attacks. The wide adoption of Joomla and its extensions means a significant number of organizations could be vulnerable if they are running the specified version of the NextGen Editor.

Recommendation

• Patch CVE-2017-20252 immediately by updating the Joomla NextGen Editor component to a version beyond 2.1.0 or by removing it if no longer needed.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect exploitation attempts.
• Ensure webserver access logs are collected and ingested for the webserver logsource category, enabling detailed detection of malicious GET requests and SQL injection attempts.