Vulnerabilidade do phpMyAdmin

[NullRoute]

Revisando os feeds que assino eis que vejo essa notícia um tanto quanto preocupante para todos nós que utilizamos servidores com a solução em si.
 

Citar

Developers of phpMyAdmin, one of the most popular and widely used MySQL database management systems, today released an updated version 4.8.4 of its software to patch several important vulnerabilities that could eventually allow remote attackers to take control of the affected web servers.

The phpMyAdmin project last Sunday gave an early heads-up about the latest security update through its blog, probably the first time, as an experiment to find if pre-announcements can help website admins, hosting providers and package managers better prepare for the security release.

"We are inspired by the workflow of other projects (such as Mediawiki and others) which often announce any security release in advance to allow package maintainers and hosting providers to prepare. We are experimenting to see if such a workflow is suitable for our project," phpMyAdmin release manager Isaac Bennetch told The Hacker News.

phpMyAdmin is a free, open-source administration tool for managing MySQL databases using a simple graphical interface over the web-browser.

Almost every web hosting service pre-installs phpMyAdmin with their control panels to help webmasters easily manage their databases for websites, including WordPress, Joomla, and many other content management platforms.

Besides many bug fixes, there are primarily three critical security vulnerabilities that affect phpMyAdmin versions before release 4.8.4, phpMyAdmin revealed in its latest advisory.
 

New phpMyAdmin Vulnerabilities

Details of three newly discovered phpMyAdmin vulnerabilities are as described below:

1.) Local file inclusion (CVE-2018-19968) — phpMyAdmin versions from at least 4.0 through 4.8.3 includes a local file inclusion flaw that could allow a remote attacker to read sensitive contents from local files on the server through its transformation feature.

“The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has access. An attacker must have valid credentials to log in to phpMyAdmin; this vulnerability does not allow an attacker to circumvent the login system.”

 

2.) Cross-Site Request Forgery (CSRF)/XSRF (CVE-2018-19969) — phpMyAdmin versions 4.7.0 through 4.7.6 and 4.8.0 through 4.8.3 includes a CSRF/XSRF flaw, which if exploited, could allow attackers to "perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes" just by convincing victims into opening specially crafted links.

3.) Cross-site scripting (XSS) (CVE-2018-19970) — The software also includes a cross-site scripting vulnerability in its navigation tree, which impacts versions from at least 4.0 through 4.8.3, using which an attacker can inject malicious code into the dashboard through a specially-crafted database/table name.

To address all above listed security vulnerabilities, phpMyAdmin developers today released the latest version 4.8.4, as well as separate patches for some previous versions.

Website administrators and hosting providers are highly recommended to install latest update or patches immediately.

Segue link para a materia: https://thehackernews.com/2018/12/phpmyadmin-security-update.html

Obs: Já estou verificando junto a Cloudlinux (que respondem mais rápido que o suporte do WHM) como proceder para fazer os updates/patches.

[carlosvv]

essa vulnerabilidade é a de menos comparada com as vulnerabilidades que existem nas portas do cpanel desde que ele foi criado e até hoje cpanel não corrigiu. parece que as atualizações do cpanel são apenas para alterar icones pois correções de bugs e segurança mesmo não existem. pode ser o servidor que for com ou sem cloudlinux que apenas com um comando se consegue burlar as portas do cpanel. 

[Felipe P.]

1 hora atrás, carlosvv disse:

essa vulnerabilidade é a de menos comparada com as vulnerabilidades que existem nas portas do cpanel desde que ele foi criado e até hoje cpanel não corrigiu. parece que as atualizações do cpanel são apenas para alterar icones pois correções de bugs e segurança mesmo não existem. pode ser o servidor que for com ou sem cloudlinux que apenas com um comando se consegue burlar as portas do cpanel. 

O que essa falha poderia ocasionar e o conhecimento de tamanha falha considerando o que você está informando já foi reportado diretamente ao cPanel? compartilhe conosco sobre essa falha que podemos em conjunto reportar diretamente a cPanel e talvez conseguir uma resposta mais rápida.

1 hora atrás, owsbr disse:

Revisando os feeds que assino eis que vejo essa notícia um tanto quanto preocupante para todos nós que utilizamos servidores com a solução em si.
 

Segue link para a materia: https://thehackernews.com/2018/12/phpmyadmin-security-update.html

Obs: Já estou verificando junto a Cloudlinux (que respondem mais rápido que o suporte do WHM) como proceder para fazer os updates/patches.

Obrigado pelo compartilhamento. 

Editado Dezembro 12, 2018 por Felipe Pacheco