Increase of phpMyAdmin scans
PMA (or "phpMyAdmin") is a well-known MySQL front-end written in PHP that "brings MySQL to the web" as stated on the web site[1]. The tool is very popular amongst web developers because it helps to maintain databases just by using a web browser. This also means that the front-end might be publicly exposed! It is a common finding in many penetration tests to find an old PMA interface left by an admin.
Even if PMA restricts access with a login page, there is a lack of protection against brute-force attacks. One of my favourite tool to perform such attack is Patator[2].
$ patator http_fuzz url=http://www.acme.org/pma/index.php \ method=POST \ body="pma_username=admin&;pma_password=COMBO00&server=1&target=index.php&lang=en&token= \ 0=dictionary.txt \ before_urls=http://www.acme.org/pma/index.php \ accept_cookie=1 \ follow=1 \ -x ignore:fgrep="Cannot log in to the MySQL server"
Today, I detected an increasing amount of attempts to find PMA interfaces against my honeypots. Here is an extract of the tested URLs:
/mysql/admin/ /mysql/dbadmin/ /mysql/sqlmanager/ /mysql/mysqlmanager/ /phpmyadmin/ /phpMyadmin/ /phpMyAdmin/ /phpmyAdmin/ /phpmyadmin2/ /phpmyadmin3/ /phpmyadmin4/ /2phpmyadmin/ /phpmy/ /phppma/ /myadmin/ /phpmyadmin/ /PMA/ /dbadmin/ /pma/ /db/phpmyadmin/ /db/phpMyAdmin/ /sqlmanager/ /mysqlmanager/ /php-myadmin/ /phpmy-admin/ /mysqladmin/ /mysql-admin/ /admin/phpmyadmin/ /admin/phpMyAdmin/ /admin/sysadmin/ /admin/sqladmin/ /admin/db/ /admin/web/ /admin/pMA/ /mysql/pma/ /mysql/pMA/ /sql/phpmanager/ /sql/php-myadmin/ /sql/phpmy-admin/ /sql/myadmin/ /sql/webadmin/ /sql/sqlweb/ /sql/websql/ /sql/webdb/ /sql/sqladmin/ /sql/sql-admin/ /sql/phpmyadmin2/ /sql/phpMyAdmin2/ /sql/phpMyAdmin/ /db/myadmin/ /db/webadmin/ /db/websql/ /db/dbadmin/ /db/db-admin/ /db/phpmyadmin3/ /db/phpMyAdmin3/ /db/phpMyAdmin-3/ /administrator/phpmyadmin/ /administrator/phpMyAdmin/ /administrator/pma/ /administrator/PMA/ /phpMyAdmin2/ /phpMyAdmin3/ /phpMyAdmin4/ /phpMyAdmin-3/ /php-my-admin/ /PMA2011/ /PMA2012/ /PMA2013/ /PMA2014/ /PMA2015/ /PMA2016/ /PMA2017/ /PMA2018/ /pma2011/ /pma2012/ /pma2013/ /pma2014/ /pma2015/ /pma2016/ /pma2017/ /pma2018/ /phpmyadmin2011/ /phpmyadmin2012/ /phpmyadmin2013/ /phpmyadmin2014/ /phpmyadmin2015/ /phpmyadmin2016/ /phpmyadmin2017/ /phpmyadmin2018/ /phpmanager/
Also, older releases of phpMyAdmin have multiple known vulnerabilities[3]. Databases are critical components in most modern web applications. If there is a lack of protection, it should be possible to access other (internal? confidential?) databases from a compromised phpMyAdmin. My advice is to simply NOT expose these administration tools to the wild Internet and, if it is required, to not rely on the default protection mechanisms. A simple extra protection layer is to restrict access to internal hosts or VPNs with an IP access-list. An example with Apache:
<Directory "/pma"> order deny,allow deny from all allow from 10.0.0.1 allow from 10.0.0.2 </Directory>
[1] https://www.phpmyadmin.net/
[2] https://github.com/lanjelot/patator
[3] https://www.cvedetails.com/vulnerability-list/vendor_id-784/cvssscoremin-7/cvssscoremax-7.99/Phpmyadmin.html
Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key
Reverse-Engineering Malware: Advanced Code Analysis | Singapore | Nov 18th - Nov 22nd 2024 |
Comments
<LocationMatch "admin">
Order Deny,Allow
Deny from All
Allow from 192.168.1.0/24
</LocationMatch>
<LocationMatch "Admin">
Order Deny,Allow
Deny from All
Allow from 192.168.1.0/24
</LocationMatch>
Anonymous
Aug 24th 2017
7 years ago