bugtraq - phpMyAdmin 4.4.6 Man-In-the-Middle API Github

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201505142120.t4ELKcqh002339@sf01web1.securityfocus.com>
Date: Thu, 14 May 2015 21:20:38 GMT
From: submit@...ec.org
To: bugtraq@...urityfocus.com
Subject: phpMyAdmin 4.4.6 Man-In-the-Middle API Github

phpMyAdmin 4.4.6 Man-In-the-Middle to API Github (CVE-2015-3903)
Author: Maksymilian Arciemowicz from https://cxsecurity.com
Issue type: CWE-295

Source URL:
http://cxsecurity.com/issue/WLB-2015050095

--- Description ---
As we can read

CURLOPT_SSL_VERIFYPEER option.
http://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYPEER.html
WARNING: disabling verification of the certificate allows bad guys to man-in-the-middle the communication without you knowing it. Disabling verification makes the communication insecure. Just having encryption on a transfer is not enough as you cannot be sure that you are communicating with the correct end-point.

CURLOPT_SSL_VERIFYHOST option.
http://curl.haxx.se/libcurl/c/CURLOPT_SSL_VERIFYHOST.html
When the verify value is 0, the connection succeeds regardless of the names in the certificate. Use that ability with caution!


--- MItM in libraries/Config.class.php ---

Let's see libraries/Config.class.php file

-------------------------------
https://github.com/phpmyadmin/phpmyadmin/blob/master/libraries/Config.class.php
..
// check if commit exists in Github
if ($commit !== false
&& isset($_SESSION['PMA_VERSION_REMOTECOMMIT_' . $hash])
) {
$is_remote_commit = $_SESSION['PMA_VERSION_REMOTECOMMIT_' . $hash];
} else {
$link = 'https://api.github.com/repos/phpmyadmin/phpmyadmin/git/commits/'
. $hash;
$is_found = $this->checkHTTP($link, ! $commit);
.. 
$link = 'https://api.github.com/repos/phpmyadmin/phpmyadmin'
. '/git/trees/' . $branch;
$is_found = $this->checkHTTP($link);
..
------------------------------- 

where checkHTTP() is vulnerable for MItM attack

https://cwe.mitre.org/data/definitions/295.html

-------------------------------
..
function checkHTTP($link, $get_body = false)
{
if (! function_exists('curl_init')) {
return null;
}
$ch = curl_init($link);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0); <=============== MItM
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0); <=============== MItM
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($ch, CURLOPT_USERAGENT, 'phpMyAdmin/' . PMA_VERSION);
curl_setopt($ch, CURLOPT_TIMEOUT, 5);
if (! defined('TESTSUITE')) {
session_write_close();
}
$data = @curl_exec($ch);
if (! defined('TESTSUITE')) {
ini_set('session.use_only_cookies', '0');
ini_set('session.use_cookies', '0');
ini_set('session.use_trans_sid', '0');
ini_set('session.cache_limiter', 'nocache');
session_start();
}
if ($data === false) {
return null;
}
$httpOk = 'HTTP/1.1 200 OK';
$httpNotFound = 'HTTP/1.1 404 Not Found';
..
-------------------------------

Example target URL:
https://api.github.com/repos/phpmyadmin/phpmyadmin/git/trees/master

--- Credit ---
Issue discovered by Maksymilian Arciemowicz from http://cxsecurity.com by using cIFrex (static code analysis tool http://cifrex.org ).

--- Patch ---
http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php
http://cxsecurity.com/issue/WLB-2015050095