5

Recently I find a new user is created on my 3.6.0 site and put into "administrator" group, but the "Allow User Registration" option is set to "NO", though the "enabled" and "Activated" status are both unchecked.

I upgraded Joomla to the latest 3.6.4, then I tried to delete the user, but I was lead to a 404 page saying the page isn't working.

I know Joomla's user registration system is often used to inject malicious files so I turn it off. How did this hacker manage to get by it? And does this mean he some how has compromised my super user account?

Improve this question

2 Answers 2

Reset to default
14

The main reason for 3.6.4 update was exactly what happened to you!

Security Bulletin [20161001] - Core - Account Creation states
"Inadequate checks allows for users to register on a site when registration has been disabled."

Then, additional vulnerability which was fixed by 3.6.4 was [20161002] - Core - Elevated Privileges "Incorrect use of unfiltered data allows for users to register on a site with elevated privileges."

Now, just how did hackers manage to create new user while “allow user registration” is set to “NO”, you can find in Sucuri's blog 'Details on the Privilege Escalation Vulnerability in Joomla'.
It is very interesting read, to say at least, and pretty technical, so quite imposible to duplicate here...

What is most frightening about this vulnerability is that it not only allows hacker to create an account even when account registration is disabled, but also changes the administrator’s username, password, and email address!

Additional reads on issues with registration:

So, it is crucial to update your Joomlas to 3.6.4 ASAP!

Improve this answer
3
  • Thanks! It is a little ironic that joomla sites are extremely vulnerable every time a new update is published..
    – shenkwen
    Commented Nov 7, 2016 at 16:00
  • 1
    It is not ironic, but expected!. That is why they stopped publishing details about vilnerability until they issue the patch for it. But, as usuall, hackers don't sleep and can't wait to explore the holes in unprotected sites. Good read about latest vulnerability and general security can be found in Sucuri's article 'Joomla Exploits in the Wild Against CVE-2016-8870 and CVE-2016-8869' at blog.sucuri.net/2016/10/…
    – Mikan
    Commented Nov 7, 2016 at 16:46
  • 2
    @shenkwen - Whenever a security vulnerability is found, a patch is normally released within a couple of days. It's up to you to update your system ;) Joomla ships with a plugin that sends you email notifications when there's an update available, so may be best to use it.
    – Lodder
    Commented Nov 7, 2016 at 17:02
2

There are many possible ways that the hacker has broken into your web,

I recommend you see these documents:

https://docs.joomla.org/Security

As to your question I would bet that the hacker could somehow upload a file to your website with a script that creates the user directly into the database.

With knowledge of Joomla tables and function it is relatively simple to do.

Improve this answer
1
  • 2
    he was on J3.6.0 which was vulnerable on this exact thing - a hacker could escalate and create a super user. This is what was patched with 3.6.4 release.
    – FFrewin
    Commented Nov 7, 2016 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.