How to remediate – OpenAdmin Tool Detection

1. Introduction

OpenAdmin Tool Detection identifies instances of OpenAdmin Tool for Informix (OAT) running on web servers. OAT is a PHP-based administration tool used to manage Informix database servers, and its presence indicates potential exposure of the underlying database management system. Successful exploitation could lead to unauthorised access to sensitive data within the Informix databases. This affects systems hosting PHP applications that include OpenAdmin Tool. Likely impact: Confidentiality, Integrity, Availability compromised.

2. Technical Explanation

The vulnerability arises from the presence of a publicly accessible administration tool for database management. Attackers can exploit this by attempting to access and use OAT’s features without authentication or with weak credentials. The primary risk is unauthorised access to the Informix database server. There isn’t a specific CVE associated with simply *detecting* the tool, but exploitation of vulnerabilities within OAT itself are common.

• Root cause: Publicly accessible PHP application providing administrative functions for an Informix database.
• Exploit mechanism: An attacker could access the OpenAdmin Tool interface via a web browser and attempt to enumerate database schemas, tables, or execute arbitrary SQL queries if authentication is bypassed or weak credentials are used. For example, accessing http://example.com/oat/ and attempting default login credentials.
• Scope: Web servers running PHP with the OpenAdmin Tool for Informix installed. Specific versions depend on the installation date of OAT.

3. Detection and Assessment

Confirming the presence of OAT can be done through web server inspection or by checking for specific files. Thorough assessment involves attempting to access the tool’s interface.

• Quick checks: Check your web server configuration for a directory named ‘oat’. Use ls -l /path/to/webroot/oat to list files within that directory if it exists.
• Scanning: Nessus plugin ID 16398 can identify OpenAdmin Tool installations, but results should be manually verified.
• Logs and evidence: Web server access logs may show requests for files under the /oat/ directory. Look for patterns associated with PHP scripts within that path.

ls -l /var/www/html/oat

4. Solution / Remediation Steps

The best solution is to remove OpenAdmin Tool if it’s not actively required. If needed, restrict access and harden security.

4.1 Preparation

• Dependencies: Ensure no other applications rely on OpenAdmin Tool. Roll back plan: Restore the web server backup if issues occur.
• Change window: Schedule during off-peak hours, and obtain approval from application owners if necessary.

4.2 Implementation

1. Step 1: Remove the /oat/ directory and all its contents using rm -rf /path/to/webroot/oat.
2. Step 2: Restart the web service (e.g., systemctl restart apache2 or systemctl restart nginx).
3. Step 3: Verify that the OpenAdmin Tool interface is no longer accessible via a web browser.

4.3 Config or Code Example

Before

# Directory exists in webroot
/var/www/html/oat/

After

# Directory removed from webroot
/var/www/html/ 

4.4 Security Practices Relevant to This Vulnerability

List only practices that directly address this vulnerability type. Use neutral wording and examples instead of fixed advice. For example: least privilege, input validation, safe defaults, secure headers, patch cadence. If a practice does not apply, do not include it.

• Practice 1: Least privilege – restrict access to database administration tools to only authorised personnel.
• Practice 2: Input validation – if the tool must remain active, implement strict input validation on all user-supplied data to prevent SQL injection or other attacks.

4.5 Automation (Optional)

#!/bin/bash
# Script to remove OpenAdmin Tool directory
WEBROOT="/var/www/html"
OAT_DIR="$WEBROOT/oat"
if [ -d "$OAT_DIR" ]; then
  echo "Removing OpenAdmin Tool directory: $OAT_DIR"
  rm -rf "$OAT_DIR"
  systemctl restart apache2 # Or nginx, depending on your setup.
else
  echo "OpenAdmin Tool directory not found."
fi

5. Verification / Validation

Confirm the removal of OAT by attempting to access its interface and checking web server logs.

• Post-fix check: Attempt to access http://example.com/oat/ in a web browser. Expected output: A 404 Not Found error or similar.
• Re-test: Repeat the quick checks from section 3 (ls -l /path/to/webroot/oat) to confirm the directory is gone.
• Smoke test: Verify that other web applications hosted on the server are functioning correctly.

curl -I http://example.com/oat/

6. Preventive Measures and Monitoring

Suggest only measures that are relevant to the vulnerability type. Use “for example” to keep advice conditional, not prescriptive.

• Baselines: Update your security baseline to include a check for unnecessary administration tools like OpenAdmin Tool.
• Asset and patch process: Regularly review installed software on web servers to identify and remove unused applications.

7. Risks, Side Effects, and Roll Back

• Roll back: Restore the web server backup created in step 4.1.

8. References and Resources

• Vendor advisory or bulletin: http://openadmintool.org/