Using a quick start package may be the quickest way to get a fully set up , add your content site. but are you aware of the dangers.
we tested several quick starts from major providers ranging from Template developers and extension developers who include a ready to go version of Joomla.
We found that there were varying degrees of insecurities. None of these packages are plug/play/forget.
The most common issue and vulnerability was the use of out of date version of Joomla. When (at the time of writing) Joomla is 3.5.1 we found the worst case was 3.3.1 with several security vulnerabilities. Possibly the worst one was an extension developer charging for a download that included 2.5.29
On 11th May 2018 the VEL were alerted to an apparently malicious extension. A user had found that the extension Nexevo Contact Form had PHP code hidden inside a PNG file, and had reported it to the JED.
We investigated and found this to be correct. The file was modules/mod_nexevocontact/helpers/loading.png. Upon further review of the code, we found additional malicious code in the other module helper files, dateSelect.php and imageCache.php. Together, what this code was designed to do, was to install a malicious system plugin called System - Section. The code for the plugin was hidden in the PNG file.
System - Section is disguised as a legitimate plugin for JComments. In reality it has nothing to do with JComments, and the only thing that it actually does is to take content from a 3rd party site and insert it into page output. It is probably intended mainly for inserting spam links, but the way that it works is highly insecure, and there is the possibility of also executing PHP code drawn from the 3rd party site, so that it is a true back door and a high level security risk. System - Section is malware, it has no legitimate purpose, and if you ever find it installed on your site you should remove it immediately and treat your site as having been hacked. You can find advice on how to deal with this in the Joomla! security forums at forum.joomla.org .
Have you seen a vulnerability in a Joomla extension being reported elsewhere, but it is not listed on the VEL?
If so, please report it to the VEL using our reporting form here: https://vel.joomla.org/submit-vel . It only takes a couple of minutes and it gives us an opportunity to investigate. While we do actively monitor other sites we cannot read the entire internet on a daily basis and it really helps if others take the time to do this.
Things not to do:-
- ignore it
- post it to boost your ego on Twitter, but do nothing to report it to the VEL
Remember that you are doing a service to the entire Joomla community in ensuring that accurate information is conveyed to users about extension vulnerabilities.
The VEL are happy to announce the release of a JSON-formatted feed of extensions on the VEL live and resolved lists.
The feed and its data are licensed under the GPL, and may be used in any way compatible with the GPL, including being used in commercial plugins. We encourage the development of plugins that can use this data.
You can find out more here.
Please contact the developer for more information
We have had reports that extensions from joomla-pro.org may contain malicious code. If anyone has a copy of an extension downloaded from the developers site, please contact us.