CVE-2024-21726: 
Joomla vulnerability analysis and mitigation

CVE-2024-21726 is a security vulnerability discovered in Joomla's core filter component that leads to multiple Cross-Site Scripting (XSS) vulnerabilities. The issue was discovered by Sonar's Vulnerability Research Team and affects Joomla versions 5.0.2/4.4.2 and below. The vulnerability was disclosed on February 20, 2024, and impacts the popular Content Management System which powers approximately 2% of all websites worldwide (Sonar Blog, Dark Reading).

The vulnerability stems from inadequate content filtering within Joomla's core filter component. The issue involves an inconsistency in how PHP's mbstring functions handle invalid multibyte sequences, which can be exploited to bypass Joomla's input sanitization. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L (Sonar Blog).

The vulnerability allows attackers to execute multiple Cross-Site Scripting (XSS) attacks, potentially leading to remote code execution (RCE) if an administrator is tricked into clicking a malicious link. Attackers could utilize this privilege to steal sensitive data, redirect site traffic, deface the website, or install persistent malware for further compromise (Security Online, Dark Reading).

The vulnerability can be exploited by crafting a malicious link that, when clicked by an administrator, allows the injection of arbitrary JavaScript code. This can be further leveraged to customize templates and insert arbitrary PHP code, ultimately leading to remote code execution (Sonar Blog).

Joomla has released patched versions 5.0.3, 4.4.3, and 3.10.15-elts to address this vulnerability. The fix involves replacing the usage of PHP mbstring functions with regular string functions. Users are strongly recommended to update to these latest versions immediately. Additionally, keeping PHP versions up-to-date is recommended as the underlying PHP bug was fixed in versions 8.3 and 8.4 (Joomla Security, Sonar Blog).