Zero-Day Exploitation of Joomla iCagenda & Balbooa Forms: Detection & Hardening

---
title: Joomla Zero-Day iCagenda and Balbooa Forms Access
id: 8c4f9d2e-1a3b-4f5e-9b6c-7d8e9f0a1b2c
status: experimental
description: Detects potential exploitation attempts targeting zero-day vulnerabilities in iCagenda and Balbooa Forms Joomla extensions by monitoring for POST requests to these components.
references:
  - https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.web_shell
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:\    cs_method|contains:
      - 'POST'
    cs_uri_query|contains:
      - 'option=com_icagenda'
      - 'option=com_bf'
  condition: selection
falsepositives:
  - Legitimate administrative form submissions or event updates
level: high
---
title: Suspicious File Upload via Joomla Components
id: 9d5e0f3a-2b4c-5f6a-0c1d-8e9f0a1b2c3d
status: experimental
description: Detects suspicious file extensions or keywords often associated with web shell uploads during Joomla component interactions.
references:
  - https://thehackernews.com/2026/07/icagenda-and-balbooa-forms-joomla-flaws.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.web_shell
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_uri:
    cs_uri_query|contains:
      - 'option=com_icagenda'
      - 'option=com_bf'
  selection_payload:
    cs_uri_query|contains:
      - '.php'
      - 'eval('
      - 'base64_decode'
  condition: all of selection_*
falsepositives:
  - Legitimate developer debugging activity (rare in production)
level: critical

// Hunt for Joomla Zero-Day Exploitation Attempts
Syslog
| where Facility in ('WebServer', 'nginx', 'apache')
| extend Request = extract(@'\?([^ ]+)', 1, SyslogMessage)
| where isnotempty(Request)
| where Request has_all ('POST', 'index.php') and (Request has 'option=com_icagenda' or Request has 'option=com_bf')
| project TimeGenerated, ComputerIP, SyslogMessage, Request
| order by TimeGenerated desc

-- Hunt for recent modifications in Joomla vulnerable component directories
SELECT FullPath, Size, Mtime.Mode, Mtime.Secs
FROM glob(globs='/var/www/html/components/com_icagenda/**/*.php')
WHERE Mtime.Secs > timestamp(epoch=now() - duration("48h"))

-- Hunt for recent modifications in Balboa Forms directory
SELECT FullPath, Size, Mtime.Mode, Mtime.Secs
FROM glob(globs='/var/www/html/components/com_bf/**/*.php')
WHERE Mtime.Secs > timestamp(epoch=now() - duration("48h"))

#!/bin/bash
# Emergency Joomla Zero-Day Hardening Script
# Targets: iCagenda (com_icagenda) and Balbooa Forms (com_bf)

WEB_ROOT="/var/www/html"
LOG_FILE="/var/log/joomla_hardening.log"

echo "[*] Starting Joomla Zero-Day Hardening Check" | tee -a $LOG_FILE

# Function to check and disable component
check_component() {
    local comp_path="$WEB_ROOT/components/$1"
    local admin_path="$WEB_ROOT/administrator/components/$1"

    if [ -d "$comp_path" ]; then
        echo "[!] FOUND: $1 is installed." | tee -a $LOG_FILE
        
        # Check for version info (if applicable)
        if [ -f "$admin_path/$1.xml" ]; then
            echo "    Version Information:" | tee -a $LOG_FILE
            grep -E "<version>|<versionDate>" "$admin_path/$1.xml" | head -n 2 | tee -a $LOG_FILE
        fi

        echo "[!] ACTION REQUIRED: Update to latest patched version immediately." | tee -a $LOG_FILE
        echo "    If update is not available, disable the component." | tee -a $LOG_FILE
        
        # Emergency Disable Command (Commented out for safety)
        # echo "    Executing: chmod -R 000 $comp_path"
        # chmod -R 000 "$comp_path"
    else
        echo "[+] SAFE: $1 not found." | tee -a $LOG_FILE
    fi
}

check_component "com_icagenda"
check_component "com_bf"

echo "[*] Scan complete. Review $LOG_FILE." | tee -a $LOG_FILE