How to remediate – GLSA-200812-20 : phpCollab: Multiple vulnerabilities

1. Introduction

The vulnerability GLSA-200812-20 affects phpCollab, a web-based project management application. Multiple vulnerabilities exist within phpCollab that could allow attackers to execute arbitrary SQL statements and PHP code on affected systems. This poses a critical risk to the confidentiality, integrity, and availability of data stored in the phpCollab database. Systems running phpCollab are typically at risk.

2. Technical Explanation

• Root cause: Missing or inadequate input validation in multiple phpCollab scripts.
• Exploit mechanism: An attacker can inject malicious SQL code into parameters like loginForm, potentially gaining access to sensitive data or executing arbitrary commands. For example, an attacker could submit a crafted request to general/login.php with a malicious payload in the ‘loginForm’ parameter.
• Scope: Affected versions of phpCollab are those present in the Gentoo Portage tree prior to the removal of the package.

3. Detection and Assessment

Confirming vulnerability requires checking the installed version of phpCollab, or identifying evidence of exploitation attempts in logs.

• Quick checks: Check if phpCollab is installed using a package manager like emerge: emerge -pv phpcollab. If present, it indicates potential exposure.
• Scanning: Nessus plugin ID 34869 may detect this vulnerability as an example only.
• Logs and evidence: Examine web server logs for suspicious requests targeting general/sendpassword.php, general/login.php, or installation/setup.php. Look for SQL-like syntax in the request parameters.

emerge -pv phpcollab

4. Solution / Remediation Steps

The recommended solution is to unmerge phpCollab from your Gentoo system.

4.1 Preparation

• Change window: This change requires a maintenance window as it involves package removal and potential service disruption.

4.2 Implementation

1. Step 1: Unmerge phpCollab using emerge: emerge --unmerge 'www-apps/phpcollab'.

4.3 Config or Code Example

Not applicable, as the solution involves removing the application.

4.4 Security Practices Relevant to This Vulnerability

• Least privilege: Run web applications with the minimum necessary privileges to limit the impact of potential exploits.

4.5 Automation (Optional)

Not applicable, as this is a simple package removal.

5. Verification / Validation

Confirm that phpCollab has been successfully removed from the system and is no longer accessible.

• Post-fix check: Run emerge -pv phpcollab again. It should report that phpCollab is not installed.
• Re-test: Attempt to access the phpCollab web interface. It should return a “page not found” or similar error.
• Smoke test: Verify other web applications on the server are functioning as expected.

emerge -pv phpcollab

6. Preventive Measures and Monitoring

• Baselines: Update security baselines to include the removal of vulnerable applications like phpCollab.
• Asset and patch process: Maintain a regular asset inventory and patch management cycle to ensure timely removal or updates of vulnerable software.

7. Risks, Side Effects, and Roll Back

• Roll back: To restore phpCollab, re-merge the package using emerge --ask 'www-apps/phpcollab'. This assumes the original package files are still available in the Gentoo repository.

8. References and Resources

• Vendor advisory or bulletin: https://security.gentoo.org/glsa/200812-20
• NVD or CVE entry: CVE-2006-1495, CVE-2008-4303, CVE-2008-4304, CVE-2008-4305