0

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time.

After fixing the gap and changing the passwords, what are some ways to detect if the server has been intruded?

Is it true that the vulnerability only allows read-access? Can audit logs still be trusted?

0

It appears that the CVSS "Integrity" metric is "N" for None:

AV:N/AC:L/Au:S/C:P/I:N/A:N

http://cve.circl.lu/cve/CVE-2017-12419

Even though this exploit provides read-only, it is unclear what remote files are accessible. At the very least, any passwords stored in PHP files are likely compromised.

Under Linux, you will want to verify which user is running PHP on behalf of the web server, and what permissions that user has.

The proof of concept in the vulnerability report tries to read /etc/passwd which is a common root access check.

https://www.mantisbt.org/bugs/view.php?id=23173

It would be unclear if you could trust server logs if root access was possible.

2
  • If you down vote an answer, it would be nice to know why ;) – dark_st3alth Jun 17 '20 at 16:54
  • not me..͏͏͏͏͏͏͏ – Pacerier Jun 18 '20 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.