Date: Thu, 20 May 2004 09:40:23 -0400
From: "Michael Curtis" <email@...to.us>
To: <bugtraq@...urityfocus.com>
Cc: "Kenneth Peiruza" <kenneth@...urity.gft.com>,
	<ilias@...enberg.com>, <josh@...nel.net>
Subject: Re: Non-logged Brute Force Attack Vulnerability forFantastico-Created Databases on cPanel Based Hosts


It appears that on my cpanel testbed, 'show databases' privileges are
already revoked.
E.g:
root@<removed> [~]# mysql -u <removed> -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 264567 to server version: 4.0.18-standard

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> show databases;
Empty set (0.04 sec)

This server has several hundred databases on it, none are listed...

Executing this as root gives me a full listing however.

As per http://dev.mysql.com/doc/mysql/en/Show_database_info.html:
"As of MySQL 4.0.2, you will see only those databases for which you have
some kind of privilege, if you don't have the global SHOW DATABASES
privilege."

It appears my chmod solution does work.

NOTE to developers (both cpanel and fantastico):
I have released this information publicly instead of contacting you directly
and not releasing it as this is a immediate problem which can be fixed by
anyone with root ssh access by typing one command.
Also, this problem may be relevant to anyone running a webhosting box with
perl/php support and mysql.

Regards,
Michael Curtis

----- Original Message ----- 
From: "Kenneth Peiruza" <kenneth@...urity.gft.com>
To: "Michael Curtis" <email@...to.us>
Cc: <bugtraq@...urityfocus.com>
Sent: Thursday, May 20, 2004 5:48 AM
Subject: Re: Non-logged Brute Force Attack Vulnerability
forFantastico-Created Databases on cPanel Based Hosts


>
> This method is cool but the solution proposed ( chmod 751
> /var/lib/mysql) has little or no effect 'cause you actually have a mysql
> login & password which can allow you to perform a "Show Databases" SQL
> query.
>
> Another choice is to activate "SQL safe mode" in php.ini, which would
> deny any kind of login attempt into any database, but Perl would still
> be an option :/
>
> The only way to completly close it at one point is to avoid listing the
> available databases at MySQL, but dunno how to do it!
>
> Cheers
>
>
>
> On dc, 2004-05-19 at 19:26, Michael Curtis wrote:
> > Advisory: cPanel/Fantastico/mysql local vulnerability
> > Date: 5/19/04
> > By: Michael Curtis (email [at] curto [dot] us)
> > System: Redhat Enterprise 3 ES / cPanel 9.3.0-R5 (most likely all redhat
> > versions with all cpanel versions)
> > Severity: High, full compromise of local databases, password retrieval
> >
> > Background:
> > cPanel is one of the leading and most feature filled scripted webhosting
> > systems for Linux and bsd platforms. It is a add on installed on top of
a
> > existing operating system installation which adds multiple features for
> > management and use of webhosting/email/ftp/database accounts.
> > Fantastico is a add on for cPanel to automate installation of website
> > scripts such as Invision Power Board, PHP-Nuke, OS Commerce, CubeCart
and
> > phpCOIN to name just a few.
> >
> > Problem Description:
> > Due to relaxed logging, insecure chmod permissions on /var/lib/mysql and
> > predictable usernames for mysql databases it is possible for a malicious
> > user (with a existing account) to upload a php or Perl script which can
be
> > used to enact a brute force attack on mysql databases on the server.
> >
> > Impact:
> > Full compromise of all databases on server (with time), may lead to
> > deduction of passwords for other accounts.
> >
> > Theoretical Proof of Concept:
> > All users have read access to the directory /var/lib/mysql which
contains
> > folders with the same names as databases hosted on the server. At this
point
> > a brute force attack could be staged, but the username is not
necessarily
> > the same as the database name.
> > However, when databases are created through fantastico... the database
name
> > and username ARE the same.
> > E.g. When you install invision board (first install) it creates both a
> > database and username in the format [username]_ibrd1
> > The optimal form of attack would be to target the fantastico created
> > databases as the username can be determined from the database name. A
script
> > could easily ls/grep/sed this list from /var/lib/mysql. Then it would
merely
> > be a case of a standard brute force attack against those databases using
> > those usernames. The attack could be dictionary based or sequential.
> >
> > As there is no logging of incorrect mysql logins (AFAIK) this could not
be
> > detected other than the massive load it would generate. On a host
without
> > suexec/phpsuexec this load would not be traceable (other than the
> > apache-status page, but the url can be obfuscated by using ~username
> > somewhat). Also, the bandwidth generated between mysql and apache is not
> > logged or measured.
> >
> > Due to the ease of exploit of this vulnerability no proof of concept
code
> > will be released.
> >
> > Solution:
> > On our test bed (Redhat Enterprise 3 ES / cPanel 9.3.0-R5)
/var/lib/mysql is
> > owned by mysql.mysql but is chmod 755. By simply changing that to 751
the
> > directory listing is disabled and all databases continue to work.
> > There are still other ways for users to obtain listings of usernames,
but at
> > least this blocks the database names making it a little more difficult
to
> > attack.
> >
> >
> > Michael Curtis
> > HostSpace
> >
>
>

Powered by blists - more mailing lists