The phpMyAdmin Supply Chain Attack

What happened

A copy of phpMyAdmin 3.5.2.2 on one SourceForge mirror held a backdoor that the official release did not have. The phpMyAdmin team published advisory PMASA-2012-5 on 25 September 2012 and rated it critical.

The advisory names the mirror cdnetworks-kr-1. The advisory says two files differ. The new file server_sync.php contains a backdoor for remote PHP code execution. The file js/cross_framing_protection.js was also modified. The advisory credits the Tencent Security Response Center for the report.

The GitHub advisory describes the new file as an eval injection. A remote attacker can run any PHP code. Exploit-DB explains the trigger. An attacker sends an HTTP POST request to server_sync.php with a parameter named c that holds the payload as hex. No login is needed. Exploit-DB lists a public exploit that appeared on 10 October 2012.

Affected versions

• phpMyAdmin 3.5.2.2, only the file phpMyAdmin-3.5.2.2-all-languages.zip from the cdnetworks-kr-1 SourceForge mirror.
• The GitHub advisory lists the affected and patched version ranges as unknown. Use the presence of the file server_sync.php as the test.

Indicators of compromise

• A file named server_sync.php in the phpMyAdmin folder. The genuine release does not have it.
• A modified js/cross_framing_protection.js.
• HTTP POST requests to /server_sync.php with a parameter c= in your web server logs (Exploit-DB).

How to check

You can search the web root for the backdoor file. Run this command and change the path to your own web root. It only reads files.

find /var/www -name server_sync.php

You can also search the web server logs for requests to the file.

grep "server_sync.php" /var/log/apache2/access.log*

Any result for the file means the install came from the bad zip. A log entry with a POST request means that someone used it. The log path is an example. Use the path of your server.

What to do now

1. Search for server_sync.php in every phpMyAdmin install.
2. If the file exists, download phpMyAdmin again from a trusted mirror. This is the fix that the advisory gives.
3. Delete the old install folder. Do not delete only the one file, because js/cross_framing_protection.js was also changed.
4. Check the web server logs for POST requests to the file. If you find any, treat the server as compromised. Run a full review of the server and rotate database and server credentials.
5. Check the downloaded checksum or signature against the official release before you install.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 81

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    server_sync.php
           It now downloads from the internet and runs other programs. It did not before.

Sources

1. phpmyadmin.net/security/PMASA-2012-5/
2. github.com/advisories/GHSA-g39j-4qc9-5rh4
3. exploit-db.com/exploits/21834