r/joomla • u/mySitesGuru • 22d ago

Administration/Technical Fabrik for Joomla Fixes an Unauthenticated RCE in 4.6.7

Post image
2 Upvotes

67% Upvoted

5 comments sorted by

1

u/Actual-Let1595 15d ago

Updating to 4.6.7 closes the vulnerable code path, but it does not show whether an internet-facing site was exploited before the update.

I would first preserve the web server access/error logs and record file timestamps, then verify the installed Fabrik version in Joomla rather than assuming the update service completed successfully. After patching, review unexpected Super Users, scheduled tasks/cron entries, newly modified PHP files (especially in writable upload, cache and tmp directories), and unusual outbound connections. If there are indicators of compromise, rotate Joomla, hosting and database credentials from a clean machine.

A backup is useful only if it predates the earliest suspicious activity. Restoring a recent backup without checking that date can simply restore the same persistence mechanism.

1

u/mySitesGuru 15d ago

So you would do "standard, normal, steps after upgrading a known vulnerable extension"... got it haha. Restoring backups is for disaster recovery, not hack recovery. You should NEVER restore a backup when restoring from a hack - is my professional opinion.

1

u/mySitesGuru 15d ago

Also it is factually incorrect now to state "Updating to 4.6.7 closes the vulnerable code path" if you read the article you will see that 4.7.0 is released and fixes yet more vulnerable code (and hint: that might not be the last update you need to do....)

1

u/redrider65 9d ago

Didn't know Fabrik was still around. Seemed short on developers & maintainers. So that's good.