CVE-2020-11579: Chadhaajay Phpkb Information Disclosure

CVE-2020-11579 Overview

CVE-2020-11579 is a local file disclosure vulnerability discovered in Chadha PHPKB 9.0 Enterprise Edition. The vulnerability exists in the installer/test-connection.php file, which is part of the installation process. A remote unauthenticated attacker can exploit this flaw to disclose local files on hosts running PHP versions before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled.

This vulnerability leverages the MySQL client-server protocol to trick the application into sending local file contents to a rogue MySQL server controlled by the attacker. The attack exploits the LOAD DATA LOCAL INFILE MySQL functionality, which can be abused when an application connects to an attacker-controlled database server.

Critical Impact

Unauthenticated remote attackers can read arbitrary local files from vulnerable PHPKB installations, potentially exposing sensitive configuration files, credentials, and application source code.

Affected Products

• Chadha PHPKB 9.0 Enterprise Edition
• PHP versions prior to 7.2.16
• Systems with MySQL ALLOW LOCAL DATA INFILE enabled

Discovery Timeline

• 2020-09-03 - CVE-2020-11579 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-11579

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The installer/test-connection.php script, intended for database connection testing during installation, lacks proper authentication controls and remains accessible even after installation completes.

The core issue lies in how the PHP MySQL client handles connections to untrusted database servers. When connecting to a MySQL server, the client can be instructed to send local files to the server via the LOAD DATA LOCAL INFILE command. An attacker can set up a malicious MySQL server that requests arbitrary local files from the connecting PHP application.

The vulnerability is particularly dangerous because the installation directory and its scripts are often left in place after deployment, creating a persistent attack surface. The attacker needs only network access to the target application to exploit this flaw.

Root Cause

The root cause is the combination of two security issues: first, the test-connection.php script does not require authentication and accepts user-supplied database connection parameters; second, PHP versions before 7.2.16 did not properly restrict the LOAD DATA LOCAL INFILE functionality by default. When these conditions are met, the application will connect to any MySQL server specified by the attacker and automatically respond to file read requests from that server.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker performs the following steps:

1. Sets up a rogue MySQL server configured to request local files upon client connection
2. Sends a crafted request to the vulnerable test-connection.php endpoint with their malicious server's address
3. The PHPKB application connects to the attacker's MySQL server
4. The rogue server responds with a LOAD DATA LOCAL INFILE request for a target file (e.g., /etc/passwd or application configuration files)
5. The PHP MySQL client sends the file contents to the attacker's server

The attacker can iterate this process to extract multiple files from the target system. For detailed technical analysis and proof-of-concept code, refer to the Shielder Blog on MySQL Exploit and the GitHub PoC Repository.

Detection Methods for CVE-2020-11579

Indicators of Compromise

• Unexpected outbound MySQL connections (port 3306) from web servers to external IP addresses
• Access log entries showing requests to /installer/test-connection.php from external sources
• Network traffic containing LOAD DATA LOCAL INFILE commands in MySQL protocol streams
• Unusual file access patterns on web server hosts, particularly to sensitive configuration files

Detection Strategies

• Monitor web access logs for requests to installation scripts, particularly test-connection.php
• Implement network monitoring for outbound MySQL connections to non-whitelisted database servers
• Deploy Web Application Firewall (WAF) rules to block access to installation directories from external sources
• Use file integrity monitoring to detect unauthorized access to sensitive system files

Monitoring Recommendations

• Enable verbose logging on PHP and MySQL connections to capture connection attempts to unusual destinations
• Set up alerts for any access to the /installer/ directory path in production environments
• Monitor for network connections originating from web server processes to external MySQL ports
• Review and audit MySQL configuration regularly to ensure LOCAL INFILE is disabled when not required

How to Mitigate CVE-2020-11579

Immediate Actions Required

• Remove or restrict access to the /installer/ directory immediately after completing PHPKB installation
• Upgrade PHP to version 7.2.16 or later, which disables LOAD DATA LOCAL INFILE by default
• Set mysqli.allow_local_infile = Off in your php.ini configuration file
• Implement firewall rules to block outbound MySQL connections from web servers to unauthorized destinations

Patch Information

There is no vendor-specific patch information available in the CVE data. Organizations should apply the recommended workarounds and ensure the installation directory is removed or protected. Contact the PHPKB vendor through their official website for updated software versions. Additionally, upgrading to PHP 7.2.16 or later provides protection at the PHP runtime level by disabling the vulnerable functionality by default.

Workarounds

• Delete the entire /installer/ directory from production PHPKB installations
• Use .htaccess or web server configuration to deny all access to installation scripts
• Configure PHP with mysqli.allow_local_infile = Off to prevent local file reads via MySQL
• Implement network segmentation to prevent web servers from initiating outbound database connections to arbitrary hosts

# Configuration example
# Remove installer directory (recommended)
rm -rf /var/www/html/phpkb/installer/

# Or restrict access via Apache .htaccess
echo "Deny from all" > /var/www/html/phpkb/installer/.htaccess

# Disable LOCAL INFILE in PHP configuration
echo "mysqli.allow_local_infile = Off" >> /etc/php.ini

# Restart web server to apply changes
systemctl restart apache2