Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time.
After fixing the gap and changing the passwords, what are some ways to detect if the server has been intruded?
Is it true that the vulnerability only allows read-access? Can audit logs still be trusted?
It appears that the CVSS "Integrity" metric is "N" for None:
AV:N/AC:L/Au:S/C:P/I:N/A:N
http://cve.circl.lu/cve/CVE-2017-12419
Even though this exploit provides read-only, it is unclear what remote files are accessible. At the very least, any passwords stored in PHP files are likely compromised.
Under Linux, you will want to verify which user is running PHP on behalf of the web server, and what permissions that user has.
The proof of concept in the vulnerability report tries to read /etc/passwd which is a common root access check.
https://www.mantisbt.org/bugs/view.php?id=23173
It would be unclear if you could trust server logs if root access was possible.
/etc/passwd requires root - that is false. Every process can read this file. The access rights are -rw-r--r-- and the file is owned by root.