CVE-2020-35613: Joomla! SQL Injection Vulnerability

CVE-2020-35613 Overview

CVE-2020-35613 is a SQL Injection vulnerability discovered in Joomla! versions 3.0.0 through 3.9.22. The vulnerability stems from improper filter blacklist configuration in the backend user list component (com_users), allowing attackers to inject malicious SQL queries through the administrative interface.

Critical Impact

This SQL Injection vulnerability enables attackers to execute arbitrary SQL commands against the Joomla! database, potentially leading to complete database compromise, data exfiltration, unauthorized data modification, and administrative account takeover.

Affected Products

• Joomla! 3.0.0 through 3.9.22

Discovery Timeline

• 2020-12-28 - CVE-2020-35613 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-35613

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection) and affects the com_users component within the Joomla! administrative backend. The flaw exists in how the user list view processes filter parameters, where an incomplete blacklist implementation fails to properly sanitize user-supplied input before incorporating it into SQL queries.

SQL Injection vulnerabilities in content management systems like Joomla! are particularly dangerous because they provide direct access to the underlying database where sensitive information such as user credentials, session tokens, and configuration data are stored. In this case, the vulnerability is accessible through the backend user list functionality, meaning an attacker with administrative panel access could exploit it to escalate privileges or extract sensitive data.

Root Cause

The root cause of CVE-2020-35613 lies in the improper configuration of the input filter blacklist within the com_users list view component. The blacklist mechanism, designed to prevent malicious characters and SQL syntax from being passed to database queries, was incomplete or improperly implemented. This allowed certain SQL injection payloads to bypass the filtering mechanism and be directly concatenated into SQL statements executed against the database.

Attack Vector

The attack vector is network-based and targets the Joomla! administrative backend interface. An attacker can exploit this vulnerability by:

1. Accessing the Joomla! administrative panel (typically at /administrator)
2. Navigating to the Users component list view
3. Manipulating filter parameters within the user list interface
4. Injecting malicious SQL payloads through the improperly filtered input fields
5. The malicious SQL is executed against the database, returning unauthorized data or modifying database contents

The vulnerability requires network access to the administrative interface but does not require prior authentication according to the vulnerability characteristics, making it particularly severe.

Detection Methods for CVE-2020-35613

Indicators of Compromise

• Unusual SQL error messages appearing in Joomla! logs or web server error logs
• Unexpected database queries containing SQL syntax characters (', ", --, ;, UNION, SELECT) in access logs
• Anomalous access patterns to the /administrator/index.php?option=com_users endpoint
• Database audit logs showing unauthorized data access or modification attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns targeting Joomla! administrative endpoints
• Monitor HTTP request parameters for common SQL injection signatures and encoded payloads
• Enable and review Joomla! system logs for suspicious activity in the com_users component
• Deploy database activity monitoring to detect anomalous query patterns

Monitoring Recommendations

• Configure real-time alerting for SQL injection attack signatures in WAF and IDS/IPS systems
• Establish baseline behavior for administrative panel access and alert on deviations
• Monitor database query execution times and result set sizes for anomalies indicative of data exfiltration
• Review access logs for repeated requests to the user list endpoint with varying parameters

How to Mitigate CVE-2020-35613

Immediate Actions Required

• Upgrade Joomla! installations to version 3.9.23 or later immediately
• Implement Web Application Firewall rules to block SQL injection attempts targeting Joomla! components
• Restrict access to the Joomla! administrative backend to trusted IP addresses only
• Review database and application logs for evidence of prior exploitation attempts

Patch Information

Joomla! has released a security patch addressing this vulnerability. According to the Joomla Security Advisory #831, users should upgrade to Joomla! version 3.9.23 or later to remediate this SQL Injection vulnerability. The patch corrects the filter blacklist configuration to properly sanitize input before use in SQL queries.

Workarounds

• Implement WAF rules to filter and block requests containing SQL injection patterns targeting the com_users component
• Restrict administrative backend access via .htaccess or web server configuration to allow only trusted IP addresses
• Disable or limit access to the user list functionality until patching is completed
• Enable Joomla!'s two-factor authentication to add an additional security layer for administrative access