Penetration Test Report (iSEC): NCC Group   phpMyAdmin

phpMyAdmin
Web Application Security Assessment
phpMyAdmin
May 18, 2016 – Version 1.2
Preparedfor
MichalČihař
GervaseMarkham
Preparedby
CaraMarie
ValentinLeon
©2016–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc.forphpMyAdmin.Portionsofthisdocumentandthetemplatesusedinitsproduction
arethepropertyofNCCGroupandcannotbecopied(infullorinpart)withoutNCCGroup'spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,andtheauthor(s)assumeno
responsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformationcontainedherein.UseofNCCGroup's
servicesdoesnotguaranteethesecurityofasystem,orthatcomputerintrusionswillnotoccur.
2|phpMyAdmin phpMyAdmin/NCCGroupconfidential
Executive Summary
Synopsis • Unauthenticated exposure of the Cross-Site Request
In the spring of 2016, Mozilla engaged NCC Group Forgery (CSRF) protection token that could allow an
to perform a security assessment of phpMyAdmin as attackertoperformvariousattacksagainstphpMyAd-
part of Mozilla's Secure Open Source (SOS) Fund.1 minusers.
phpMyAdmin is a free and open source application • Severaltrafficflowsthatexposesensitivedataormake
that has been one of the defacto tools for managing use of plaintext HTTP communications. This could
and maintaining MySQL databases for years. Its wide allow an attacker to man-in-the-middle, perform
adoptionmatchedwithitspotentialformisuse,warrants CSRF, or various other attacks against phpMyAdmin
regularreviewfromasecurityperspective. users.
This assessment was performed remotely by two NCC Limitations
Groupconsultants,CaraMarieandValentinLeon,over No major blockers were encountered during this as-
a period of two weeks from April 25th to May 6th. sessment. Testing environments had to be setup by
The assessment was conducted as a code-assisted NCC Group consultants but this setup process was
penetrationtestofphpMyAdminversion4.6.0(current simple and automated, which helped the consultant
release as of this writing). phpMyAdmin provided team deliver value on the first day of testing. Source
access to key members of the development team and code was available on the GitHub project page and
wascommittedtomakingthisprojectasuccess. access to internal repositories was granted on the first
dayoftesting.
Scope
NCCGroup'sevaluationincluded: SecurityRecommendations
In addition to the recommendations specified in each
• Mainapplicationportal: Thisportalisa MySQL web
ofthevulnerabilitydetails,implementingthefollowing
administrationtool. Theinterfacesupportsuserand
high-levelrecommendationswillallowphpMyAdminto
databasemanagement,andaconsolefordirectSQL
gainastrongersecuritystance.
statementandqueryexecution.
• Setupportal: ProvidesaninterfaceforphpMyAdmin • Update phpMyAdmin to support modern security-
application configuration, including security, import, relatedheaders—HTTPStrictTransportSecurityand
export,andSQLquerysettings. astricterContentSecurityPolicy. Toenableastricter
• Source code: While the focus of the assessment ContentSecurityPolicies(CSP)(seeVulnerability002),
was not purely code review, NCC Group reviewed NCCGrouprecommendsremovingalllegacyscripts
sectionsdealingwithauthentication,inputvalidation, insertedasinlineJavaScriptandmovethemtoscript
andcommandexecution. filesseparatefromtheHTMLsource.
• Restrict all state changing actions to occur via HTTP
Testenvironmentswerecreatedusingtheprecompiled
POST.Allowingstatechangingrequeststobesentvia
phpMyAdmin packages hosted on https://launchpad.
GETcanleaksensitivedata(seeVulnerability001)and
net/~nijel/+archive/ubuntu/phpmyadmin.
allow attackers to perform numerous attacks against
KeyFindings phpMyAdmin. Thisviolatessecuritybestpractices.
• Provide users with hardening guides at install time
The assessment uncovered several application flaws.
andwarnusersaboutpotentialmisconfigurations,to
Someofthemorenotablewere:
reducetheriskofinsecureinstallations.
• AlackoffilteringonuserCSVoutputthatcouldallow • ConsiderrequiringinstallationstouseTLSbydefault.
anattackertorunarbitrarycodeonanadministrator's Ifusershavenotalreadyacquiredcertificates,thenthe
computer. installation process should direct them through the
• Improper cookie invalidation that could allow an processforacquisitionviaLet'sEncrypt.2
attackertounsetinternalglobalvariables. • Considerimplementinganout-of-datesoftwarewarn-
ingtoaidusersinmaintainingup-to-dateandsecure
phpMyAdmininstances.
1https://wiki.mozilla.org/MOSS/Secure_Open_Source
2https://letsencrypt.org/
3|phpMyAdmin phpMyAdmin/NCCGroupconfidential
Project Dashboard
TargetMetadata EngagementData
Name phpMyAdmin Type Webapplicationsecurity
assessment
Type Webapplication
Method Code-assisted
Version 4.6.0
Dates 2016-04-25to2016-05-06
Platform PHP
Consultants 2
Levelofeffort 4person-weeks
Targets
Buildsite https://launchpad.net/~nijel/+archive/ubuntu/phpmyadmin
Source https://github.com/phpmyadmin/phpmyadmin/tree/RELEASE_4_6_0/—commit
37b38431d167915675fc8ab[PII_REDACTED]47e72de
VulnerabilityBreakdown
CriticalRiskissues 0
HighRiskissues 0
MediumRiskissues 3
LowRiskissues 5
Informationalissues 1
Totalissues 9
CategoryBreakdown
Authentication 1
DataExposure 3
DataValidation 4
SessionManagement 1
Key
Critical High Medium Low Informational
4|phpMyAdmin phpMyAdmin/NCCGroupconfidential
Table of Vulnerabilities
Foreachfinding,NCCGroupusesacompositeriskscorethattakesintoaccounttheseverityoftherisk,application's
exposureanduserpopulation,technicaldifficultyofexploitation,andotherfactors.ForanexplanationofNCCGroup's
riskratingandvulnerabilitycategorization,seeAppendixAonpage15.
Title ID Risk
CSVExportAllowsArbitraryCommandExecutioninCSVFile 006 Medium
Login/LogoutActionsVulnerabletoCSRF 007 Medium
AbilitytoUnsetArbitraryServerGlobalVariables 009 Medium
SensitiveValuesVulnerabletoSessionFixation 005 Low
SensitiveDatainURLGETQueryParameters 001 Low
OverlyPermissiveContentSecurityPolicy 002 Low
FileTraversalProtectionBypassonErrorReporting 004 Low
SelfXSSintable_row_action.php 008 Low
MultipleHTTPPlaintextLinks 003 Informational
5|phpMyAdmin phpMyAdmin/NCCGroupconfidential
Vulnerability Details
Vulnerability CSVExportAllowsArbitraryCommandExecutioninCSVFile
Risk Medium Impact: Medium,Exploitability: High
Identifier NCC-1604_MOSS_phpMyAdmin-006
Category DataValidation
Location TheCSVExportfunctionality3
Impact AmalicioususercanchangeadatabasefieldsothatwhenanadministratorusestheExport
functionalityandopenstheexportedCSVinaspreadsheeteditorsuchasExcel,codemay
berunontheadministrator'scomputer. Alternatively,amaliciousorcompromisedadmin-
istrator can add or modify users with formulas in various fields to target other application
administratorsandusers.
Description TheCSVExportfunctionalitydoesnotproperlyescapeexportedCSVfieldvalues. Thiscan
lead to code execution on a user's computer. This is done by including a formula in the
CSV file that a spreadsheet editor similar to Excel will evaluate — the formula can include
commands to be run on the user's computer. For example, if a user changes a database
name or column value to be =cmd|' /C calc'!A0 and the database is then exported in
CSVformatbyanotheruser,calc.exewillrunwhenthefileisevaluatedbyaspreadsheet
editor.
The victim user will be prompted with a warning, but since the user has downloaded the
CSVfromatrustedsource,theyarelikelytoallowthefunctionality. Itshouldbenotedthat
encapsulatingthevalueswithquotationmarks(")doesnotmitigatetheissue.
ReproductionSteps 1. LogintophpMyAdminandinsert=cmd|' /C calc'!A0intoadatabasecolumnvalue.
2. ExportthedatabaseinCSVformat.
3. Open the exported CSV file that was exported in Windows Excel and click through the
warnings.
4. Observethecalculatorapplicationnowrunningonthecomputer.
Recommendation WhenperformingaCSVExport,foranycellthatstartswithan=,-,",@,or+,addaspaceto
thebeginningandremoveanytabcharacters(0x09)inthecell. Alternatively,prependeach
cell field with a single quote, so that their content will be read as text by the spreadsheet
editor.
3https://github.com/phpmyadmin/phpmy