CVE-2025-22204: Regularlabs Sourcerer RCE Vulnerability

CVE-2025-22204 Overview

CVE-2025-22204 is a critical remote code execution vulnerability affecting the Sourcerer extension for Joomla developed by Regular Labs. The vulnerability stems from improper control of code generation (CWE-94) in versions prior to 11.0.0, allowing unauthenticated attackers to execute arbitrary code on vulnerable Joomla installations remotely over the network.

The Sourcerer extension is designed to allow Joomla administrators to embed PHP, CSS, JavaScript, and other code directly into Joomla articles and modules. This powerful functionality, when improperly secured, creates an ideal attack surface for code injection attacks.

Critical Impact

Unauthenticated attackers can achieve complete server compromise through remote code execution, potentially leading to full data exfiltration, website defacement, or lateral movement within the hosting infrastructure.

Affected Products

• Regular Labs Sourcerer versions prior to 11.0.0
• Joomla CMS installations with vulnerable Sourcerer extension

Discovery Timeline

• 2025-02-04 - CVE-2025-22204 published to NVD
• 2025-06-04 - Last updated in NVD database

Technical Details for CVE-2025-22204

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly referred to as code injection. The Sourcerer extension's core functionality involves parsing and executing embedded code within Joomla content, which creates an inherent security risk if input validation and access controls are not properly implemented.

The attack can be executed remotely over the network without requiring any authentication or user interaction. A successful exploit grants the attacker the ability to achieve high-impact compromise across confidentiality, integrity, and availability of the affected system.

The EPSS data indicates a probability of 4.33% with a percentile ranking of 88.778, suggesting this vulnerability is more likely to be exploited than approximately 89% of all CVEs tracked.

Root Cause

The root cause lies in the improper control of code generation within the Sourcerer extension. The extension fails to adequately sanitize or restrict the code that can be generated and executed through its parsing mechanisms. This allows attackers to inject and execute arbitrary code through the extension's code processing functionality.

In code injection vulnerabilities like this, the application dynamically generates code based on user-controlled input without proper validation, allowing malicious code to be incorporated into the generated output and subsequently executed by the server.

Attack Vector

The attack vector is network-based, meaning exploitation can occur remotely over the internet. Given that this is an unauthenticated vulnerability with no user interaction required, attackers can potentially automate exploitation at scale against vulnerable Joomla installations.

The attacker would craft malicious input designed to abuse the Sourcerer extension's code generation capabilities. When processed by the vulnerable extension, this input results in arbitrary code execution on the web server hosting the Joomla installation.

For technical details on the vulnerability mechanism, refer to the Regular Labs Sourcerer Tool documentation and any security advisories published by the vendor.

Detection Methods for CVE-2025-22204

Indicators of Compromise

• Unexpected PHP files or webshells appearing in Joomla directories
• Unusual outbound network connections from the web server
• Modified Joomla core files or extension files with injected code
• Suspicious entries in web server access logs showing unusual POST requests to Joomla endpoints

Detection Strategies

• Monitor web application logs for unusual requests targeting Sourcerer extension endpoints
• Implement Web Application Firewall (WAF) rules to detect code injection patterns in HTTP requests
• Conduct regular file integrity monitoring on Joomla installation directories
• Review server process lists for unexpected child processes spawned by the web server

Monitoring Recommendations

• Enable verbose logging for the Joomla application and web server
• Set up alerts for any execution of system commands from the web server context
• Monitor for new file creation or modification in the Joomla installation path
• Implement network traffic analysis to detect command-and-control communications

How to Mitigate CVE-2025-22204

Immediate Actions Required

• Upgrade the Sourcerer extension to version 11.0.0 or later immediately
• If immediate upgrade is not possible, disable or uninstall the Sourcerer extension until patching can be completed
• Audit Joomla installations for signs of compromise before and after patching
• Review server logs for evidence of exploitation attempts

Patch Information

Regular Labs has addressed this vulnerability in Sourcerer version 11.0.0. Administrators should update to this version or later through the Joomla extension manager or by downloading directly from the Regular Labs website. After updating, verify the installed version through the Joomla administrator panel.

Workarounds

• Temporarily disable the Sourcerer extension via Joomla's Extension Manager if patching is not immediately feasible
• Implement WAF rules to block suspicious requests containing code injection patterns
• Restrict access to the Joomla administrator panel to trusted IP addresses only
• Consider implementing additional server-level protections such as disable_functions in PHP configuration to limit the impact of potential code execution

# Verify Sourcerer extension version in Joomla
# Navigate to: Extensions > Manage > Manage
# Search for "Sourcerer" and verify version is 11.0.0 or later

# Alternative: Check version via command line
grep -r "version" /path/to/joomla/plugins/system/sourcerer/sourcerer.xml

# Disable extension via CLI if needed (Joomla 4+)
php cli/joomla.php extension:discover
php cli/joomla.php extension:disable sourcerer