5

First of all, I would like to check myself:

  • An extension is an aggregate of modules, plugins and components, right?

  • If that is right, then modules, plugins and components have the same versions. Is this also true?

The problem is: As part of security research that I am conducting, I need to find out the versions of the extensions used on a (any) given Joomla site.

In simple cases, the version is already written like here:

JWallpapers - A lightweight yet powerful image gallery component with community building capabilities
 * 
 * @version 2.2.2 $Id: default.css 558 2010-12-16 12:29:41Z amazeika $
 * @package JWallpapers
 * @copyright Copyright (C) 2009 Arunas Mazeika, http://www.wextend.com. All rights reserved
 * @author Arunas Mazeika
 * @license GNU General Public License v2+ (GNU GPL v2+). See license.php
 * 
 */
#picture_container,#picture_right_content,#thumbs_right_section,#thumbs_left_section,#frontend_tagging_section,#pic_tags_section
    {
    float: left;
    border: none !important;
}

.jw_category_title {
    float: left;
    border: none !important;
} 

But how can I find out the version of an extension if there is no such record?

I also looked here but the answerer used a php-script. Is it possible for a usual user to run such a script?

Are there other ways to find out extension versions on Joomla sites?


Disclaimer: This is purely to research any possible security vulnerabilities within Joomla

UDP_1

I'm using a OWASP-ZAP to get the site's tree , I mean I get every single file in every single directory. Like this :enter image description here.

So could any module, plugin or component leave a mark somewhere else(I mean not only in ,for example, components directory)?

3

As @Sharky said, you can check the extension versions by accessing their manifest files. Here are the path of those files for each type of extension :

Component :

../administrator/components/com_extension_name/extension_name.xml

Module :

../modules/mod_extension_name/mod_extension_name.xml

Plugin :

../plugins/plugin_type/extension_name/extension_name.xml

Template :

../templates/extension_name/templateDetails.xml
  • 1
    This will really depend on the hosting/dns providers as a lot of them block direct access to these files – Lodder Jul 5 at 6:41
  • Let me add that if you can access these files, it's already an insecure site, you don't need to look any farther. Responsible sysadmins don't let things like this happen. Extremely responsible ones log the attempts and forward them to law enforcement as break-in attempts (which they are). – Arlen Jul 11 at 19:06
  • @Lodder Arlen, considering this is indeed a security issue, I'm just wondering, why does it seem like there's no effort from Joomla Dev to protect this, maybe something like adding an acccess restriction to xml files in the default htaccess files? – webchun Jul 12 at 9:39
  • @Arlen does it mean joomla.org considered as an insecure site, as I'm able to access xml file from the website? joomla.org/templates/joomla/templateDetails.xml – webchun Jul 12 at 9:43
  • In the case of a template the info leak is less serious, but it's still an info leak. Being able to access the manifests of installed modules and components and thus expose information about precisely what is being loaded is bad practice. One should never be able to access the components/modules/plugins tree with an http request, e.g., virtually every editor exploit depends upon this door being open. The template tree is as hard to secure as the images tree or media tree, as legitimate requests can go there. – Arlen Jul 12 at 13:00
3

If you're not an administrator of the site, you can't have this information in full. If you know which extensions are installed, you can check their versions by accessing their manifest files. For example, you can find out Joomla! version by accessing administrator/manifests/files/joomla.xml file.

The closest you can get to finding out which extensions are installed is by compiling a list of as many extensions as you can find in the wild and writing a script to check if the manifest files exist on the website.

  • then what this script about?joomla.stackexchange.com/a/13761/13622 – Elvin Jul 4 at 16:36
  • 1
    The script in the link is looking at the data base table where the extensions are 'registered' and then displaying a list of name and version. Still not much good to you as you would need direct access to the database. – Irata Jul 4 at 23:49
2

the extension is an aggregate of modules, plugins and components?

A extension, is not the combination of a component, module and plugin. This is what a package is

Plugins, Modules, Components, Templates are all types of extensions.


So if I'm right, than modules, plugins and components have the same versions. Is it also true?

No. They're all separate, so they'll use different versions.


But how to find out the version of extensions if there is no such a record?

In your Joomla backend (admin panel), go to Extensions >> Manage >> Manage.

This will give you a list of all installed extensions and their respective version.

Here is an example:

enter image description here

  • but if I am a regular user and I am not allowed to use admin page? Is there another way to find out a version? – Elvin Jul 4 at 15:00
  • @Elvin - Why would you want to do this as a regular user? – Lodder Jul 4 at 15:03
  • I'm to research a security problems in Joomla but I had never worked with web-proggramming and CMS. I need only a version of installed extensions. – Elvin Jul 4 at 15:08
  • You can't get this information. See other answer – Lodder Jul 5 at 6:36
1

As Sharky says, if you don't have administrator access to the database, the best way to find out this information is from the publicly accessible files on the website such as the xml manifest files. The security on some websites does not permit you to view these files so this method is not always reliable.

Even when you do have access to the manifest files, not all versions of an extension use the same manifest file.

For some examples, see the code below where Akeeba Backup and JCE Editor use the same manifest file for all versions but for ChronoForms and Gantry Framework, you need to check several files to get the version number.

// Display Akeeba Version
echo "<div class='item'>Akeeba Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_akeeba/akeeba.xml");
if (isset($xml->version)) {
  echo "<div class='column'>$xml->version</div>";
} else {
  echo "<div class='column'>Unknown</div>";
}

// Display JCE Version
echo "<div class='item'>JCE Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_jce/jce.xml");
if (isset($xml->version)) {
  echo "<div class='column'>$xml->version</div>";
} else {
  echo "<div class='column'>Unknown</div>";
}

// Display ChronoForms Version
echo "<div class='item'>ChronoForms Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_chronoforms6/chronoforms6.xml");
if (isset($xml->version)) {
  //ChronoForms v6
  echo "<div class='column'>$xml->version</div>";
} else {
  $xml = simplexml_load_file($website . "/administrator/components/com_chronoforms5/chronoforms5.xml");
  if (isset($xml->version)) {
    //ChronoForms v5
    echo "<div class='column'>$xml->version</div>";
  } else {
    $xml = simplexml_load_file($website . "/administrator/components/com_chronoforms/chronoforms.xml");
    if (isset($xml->version)) {
      //ChronoForms v4
      echo "<div class='column'>$xml->version</div>";
    } else {
      $xml = simplexml_load_file($website . "/administrator/components/com_chronocontact/chronocontact.xml");
      if (isset($xml->version)) {
        //ChronoForms v3
        echo "<div class='column'>$xml->version</div>";
      } else {
        //Unknown
        echo "<div class='column'>Unknown</div>";
      }
    }
  }
}

// Display Gantry Version
echo "<div class='item'>Gantry Version:</div>";
$xml = simplexml_load_file($website . "/administrator/components/com_gantry5/gantry5.xml");
if (isset($xml->version)) {
  //Gantry v5
  echo "<div class='column'>$xml->version</div>";
} else {
  $xml = simplexml_load_file($website . "/administrator/components/com_gantry/gantry.xml");
  if (isset($xml->version)) {
    //Gantry v4
    echo "<div class='column'>$xml->version</div>";
  } else {
    $xml = simplexml_load_file($website . "/administrator/components/com_gantry/manifest.xml");
    if (isset($xml->version)) {
      //Gantry v3
      echo "<div class='column'>$xml->version</div>";
    } else {
      //Unknown
      echo "<div class='column'>Unknown</div>";
    }
  }
}
1

* Update * I posted this answer and then later checked the answers by Sharky and later, Neil Roberts, saying the .xml files are available. I tested this on one of my sites, so I was very surprised that this information is available and I will have to do something about that. I have left my original answer here for general reference and voted up the Answers by the others saying look for the manifest xml file in the component directories.


That information is not available to an end user or visitor to a website.

You will either need Administrator access to the back end of Joomla or access to run a database query and unless you have hacked the site you wont have that either.

As a public viewer of a website you are only going to be able to see what is available in the HTML being displayed. As explained in Lodder's answer Extensions are comprised of plugin, modules and components and for the most part they happen on the server side of things to build the pages that are then rendered and sent to your browser.

Some components may display a back link or 'powered by ....' text in the footer of a page, that is by deliberate action on their part in their code, but normally plugins and modules will barely leave any trace of themselves let alone their version. A plugin executed deep in the code of Joomla that changes a value from A to B isn't going get any credits at the bottom of a page like say people who work on a Movie get listed at the end.

You could analyse the HTML code of every page of a Joomla site and slowly build up a catalogue of breadcrumbs of evidence that an extension may or may not have had a hand in creating a page, but there would be no reliable version information. It would also take that long I would suggest you don't have that many breathes left in you.

Perhaps if you explain more about the the research you are doing and what your requirement is then perhaps people on here could suggest an alternative approach.

  • updated a bit, please,check – Elvin Jul 5 at 20:33
  • The only way they're accessible is if the sysadmin didn't lock down the site properly. There is no reason for any outside access to those files to be permitted, as they only serve as an information leak to help someone break in. Securely configured sites don't allow http access to those directories. – Arlen Jul 11 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.