Identifier: AIT-SA-20200301-01
Target: Creative Contact Form (for Joomla)
Vendor: Creative Solutions
Version: 4.6.2 (before Dec 03 2019)
CVE: CVE-2020-9364
Accessibility: Remote
Severity: High
Author: Wolfgang Hotwagner (AIT Austrian Institute of Technology)
SUMMARY
Creative Contact Form is a responsive jQuery contact form for the Joomla content-management-system.
VULNERABILITY DESCRIPTION
A directory traversal vulnerability resides inside the mailer component of the Creative Contact Form for Joomla. An attacker could exploit this vulnerability to receive any files from the server via e-mail.
The vulnerable code is located in “helpers/mailer.php” at line 290:
ERROR: Content Element with uid “47174” and type “ar_codeelem” has no rendering definition!
If an attacker puts “../../../../../../../../etc/passwd” into $_POST[‘creativecontactform_upload’], and enables “Send me a copy”, the contact-form would send him the content of /etc/passwd via email.
Note: this vulnerability might not be exploitable in the free version of Creative Contact Form since it does not allow “Send copy to sender”.
VULNERABLE VERSIONS
Creative Contact Form Personal/Professional/Business 4.6.2 (before Dec 3 2019)
IMPACT
An unauthenticated attacker could receive any file from the server
MITIGATION
Update to the current version
References
VENDOR CONTACT TIMELINE
ADVISORY URL
https://www.ait.ac.at/ait-sa-20200301-01-directory-traversal-in-creative-contact-form
WOLFGANG HOTWAGNER
Research Engineer /
Security & Communication Technologies