CRLF Injection Vulnerability in phpMyAdmin: Remote Header Injection Risk
Summary
CVE-2009-1149: CRLF injection vulnerability in bs_disp_as_mime_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via... Affects phpmyadmin versions < 4:3.1.3.1-1. Fixed in 4:3.1.3.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpMyAdmin is a widely used open-source tool for managing MySQL databases through a web interface. It provides a user-friendly environment for database administration, allowing users to execute SQL queries, manage databases, and perform various database operations. However, prior to version 3.1.3.1, phpMyAdmin was susceptible to a CRLF injection vulnerability, which could allow attackers to manipulate HTTP headers and potentially execute HTTP response splitting attacks.
Vulnerability Detail
The CRLF injection vulnerability in phpMyAdmin arises from improper handling of user input in the 'bs_disp_as_mime_type.php' file, specifically through the 'c_type' and 'file_type' parameters. This flaw allows remote attackers to inject arbitrary HTTP headers, leading to HTTP response splitting attacks. Such attacks can result in session fixation, cache poisoning, and other malicious activities, compromising the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
4:3.1.3.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade phpmyadminTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing input validation to sanitize the 'c_type' and 'file_type' parameters. This can be done by ensuring that these parameters do not contain any CRLF sequences. For example, you can add a check in your PHP code as follows: if (
strpos($c_type, '\r') !== false || strpos($c_type, '\n') !== false) { die('Invalid input');
}
Conclusion
The CRLF injection vulnerability in phpMyAdmin poses significant risks to users of the software. It is crucial to upgrade to the latest version to mitigate these risks. Additionally, implementing input validation can serve as a temporary workaround until an upgrade is possible. Regular monitoring for vulnerabilities using tools like Vulert can further enhance security.
See every vulnerability recorded for phpmyadmin →
FAQ
A CRLF injection vulnerability allows an attacker to inject carriage return (CR) and line feed (LF) characters into HTTP headers, potentially leading to HTTP response splitting and other attacks.
If you are using a version of phpMyAdmin prior to 3.1.3.1, your installation is vulnerable. You can check your version in the phpMyAdmin interface or by running 'phpmyadmin --version' in the command line.
The risks include session fixation, cache poisoning, and the potential for attackers to execute arbitrary code or steal sensitive information.
Yes, tools like Vulert can help monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for phpmyadmin.
