1

I've just been notified of a remote code execution vulnerability and an xss vulnerability on a site that I run. I've fixed the responsible code, but I'm wondering what steps should be taken afterwards to:

  1. Ensure the server is secure
  2. Ensure no data was compromised
  3. Ensure no malicious files were uploaded.

The remote code execution vulnerability was particularly bad and allowed any PHP code to be run on the server and output displayed to the user.

The app is hosted on Amazon Lightsail. Would it be helpful to redeploy on a new instance?

|improve this question
  • 2
    "Kill it with fire and stand up a new one" addresses any persistent malware on the box. You should also consider data theft and whether notifying users / forcing password resets, etc are warranted. I added the forensics tag because I suspect you don't want to panic your users unless you find evidence of compromise. To that effect, I would stand up a replacement ASAP, but keep the old one around for analysis. – Mike Ounsworth Oct 30 '18 at 20:44
2

The best solution would be to redeploy, but to answer your questions pointwise:

  1. Ensure server is secure : Try and look for any rootkits,processes running that might have been setup to set persistance.
  2. Ensure no data was compromised : Unfortunately, there is not sure way to do this as , data can be ex-filtrated very easily. You should always assume that data could have been ex-filtrated, if it is known that the server was compromised.
  3. Ensure no malicious files were uploaded : This should get covered in the first point itself. If any non-php files remain on your system,it should not cause any problem. All what you can do at this point of time is to manually search for all php files , and decide if its malicious or not.

As you see the above tasks will take a toll !!Hence its recommended that you redeploy the solution!

EDIT 1: This is only applicable for RCE. In case of XSS point of view, as long as input is santized nothing needs to be done from server-side

|improve this answer
1

Do not tear down your infrastructure - stand up a new instance and redirect to that, if you didn't have monitoring on your old instance address this.

If you can just turn off/image whatever you had stood up - you will want to get someone in to look at this to determine if a breach has occurred as it doesn't sound like you have the required skill set.

Get a penetration test performed against the application and host as its already proven insecure. I disagree with notification to all users (As an initial action) - a breach has not been confirmed and jumping into making it public will damage the reputation and has significant cost associated with it.

At this stage all you have is a vulnerability that has been addressed.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.