InfraFenceInfraFence

Live Security Operations

Get Started

CVE-2023-23752: Joomla 4 API information disclosure, check and fix

Last updated:

Joomla 4.0.0 to 4.2.7 check access to their web services API incorrectly: adding public=true to a request to /api/index.php/v1/… skips the check. The public exploit reads the site's configuration through it, and that includes the database user and password.

NVD scores it 5.3, since it only discloses information. In practice the leaked credentials open the database wherever it accepts remote connections, and attacks started right after the disclosure. CISA added it to KEV in January 2024.

At a glance

CVE
CVE-2023-23752
Software
Joomla! CMS
Affected versions
4.0.0 to 4.2.7
Fixed in
4.2.8
CVSS score
5.3 Medium (NVD, CVSS 3.1) · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA Known Exploited Vulnerabilities
Yes, added on January 8, 2024
Published by NVD
February 16, 2023
InfraFence virtual patch
vp-cve-2023-23752 (ModSecurity id 9920008)

What is affected

Joomla 4.0.0 to 4.2.7. Joomla 3 has no such API and is not affected by this CVE (it has been out of support since August 2023). The fix is Joomla 4.2.8.

Check whether a server is vulnerable

Find every Joomla on the server and print its version:

Any Linux distribution
sudo nice -n 19 ionice -c3 find / -xdev -path '*/libraries/src/Version.php' 2>/dev/null \
  | while read -r f; do
      echo "$f: $(grep -oE '(MAJOR|MINOR|PATCH)_VERSION = [0-9]+' "$f" | grep -oE '[0-9]+$' | paste -sd.)"
    done

Attempts are API requests with the public parameter:

Apache access logs
sudo grep -rhiE '/api/index\.php/v1/[^ ]*[?&]public=' --include='*access*' --exclude='*.gz' /var/log/apache2 /var/log/httpd 2>/dev/null | tail -20

Fix it

  1. Back up the site files and the database.
  2. Update Joomla from the administrator panel (System › Update › Joomla) to 4.2.8 or later, best the latest release of a supported branch.
  3. If the logs show successful requests (status 200) with public=true, treat the credentials in configuration.php as known: change the database password (and update configuration.php), the mail password and any other secret stored there.
  4. Make sure the database does not accept connections from the internet.

How InfraFence blocks it while you update

The virtual patch for CVE-2023-23752 is a ModSecurity rule that blocks a request to a path containing /api/index.php/v1/ when the query string has a public parameter. Other API requests, with their normal authentication, pass.

How the patch is applied

  1. The agent notes which SSH ports and sites answer.
  2. It writes the rule (ModSecurity id 9920008) between its own markers in its ModSecurity file, runs apachectl configtest and reloads Apache gracefully. A failed test puts the previous file back.
  3. It checks that SSH and the sites still answer, and removes the patch if they do not.
  4. It checks that ModSecurity really blocks with the rule, with a harmless local probe request. A ModSecurity in DetectionOnly only logs: the patch is then removed and reported as ineffective, never as applied.

Every request the patch blocks is reported with CVE-2023-23752 (agent 1.0.37 or later): you see the attempts on the server's activity and on the Exploitation page of the dashboard, so you know the vulnerability is being tried against you.

Warning: A virtual patch blocks the known form of the attack on the requests that go through Apache on that server. It is not a substitute for the update: install the fixed version, then remove the patch from Activity with Undo if you no longer need it.

Virtual patches need Apache with ModSecurity, the setting Allow web server configuration changes, and no hosting panel or configuration manager in charge of the web server; they are part of the Pro plan and AutoMode. A person applies them from the AI analysis, or AutoMode does. See Virtual patches.

Sources

The facts on this page come from these sources; check them for changes.

Try it free on 1 server

Starter is free for one server, with full protection and automatic blocking. No credit card.

Install the agent as root, with your token in place of <TOKEN>:

curl -fsSL https://github.com/infrafence/infrafence-agent/releases/latest/download/install.sh | sudo bash -s -- --token <TOKEN>

The token is created in the dashboard, in Servers › Add server.

Create a free accountRead the docs