CVE-2020-13166: Mylittleadmin RCE Vulnerability

CVE-2020-13166 Overview

CVE-2020-13166 is a critical remote code execution vulnerability in MyLittleAdmin 3.8, a web-based SQL Server management tool. The vulnerability exists because the application uses a hardcoded machineKey value in web.config that is identical across all customer installations. This cryptographic key is used to protect ViewState data integrity, and because it is publicly known, attackers can craft malicious serialized ASP.NET payloads that will be trusted by the application, leading to arbitrary code execution on the server.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on servers running MyLittleAdmin 3.8 by exploiting the hardcoded machineKey to forge malicious ViewState payloads, potentially leading to complete server compromise.

Affected Products

• MyLittleTools MyLittleAdmin 3.8
• Plesk hosting environments with MyLittleAdmin integration
• Any system running MyLittleAdmin with the default hardcoded machineKey configuration

Discovery Timeline

• 2020-05-19 - CVE-2020-13166 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-13166

Vulnerability Analysis

This vulnerability falls into the category of Hardcoded Credentials (CWE-798) combined with Insecure Deserialization. The root issue stems from MyLittleAdmin shipping with a static machineKey in its web.config file that never changes between installations. In ASP.NET applications, the machineKey is used to cryptographically sign and optionally encrypt ViewState data, ensuring that only the server can generate valid ViewState payloads.

When this key is hardcoded and publicly known, attackers can generate their own cryptographically valid ViewState payloads. By leveraging .NET deserialization gadget chains, an attacker can embed malicious serialized objects within the ViewState that execute arbitrary code when deserialized by the server during request processing.

The attack requires no authentication, as the ViewState deserialization occurs before any authentication checks. This makes the vulnerability particularly dangerous in internet-facing deployments, which is the typical deployment scenario for web-based database management tools.

Root Cause

The vulnerability originates from a hardcoded cryptographic key in the web.config configuration file. The machineKey element contains static validationKey and decryptionKey values that are identical in every MyLittleAdmin 3.8 installation worldwide. This design flaw violates fundamental cryptographic principles where keys should be unique per installation and kept secret.

The hardcoded machineKey allows attackers to:

1. Sign malicious ViewState payloads that the server will accept as legitimate
2. Bypass ViewState MAC validation entirely
3. Inject arbitrary serialized .NET objects into the request processing pipeline

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Obtaining the publicly known hardcoded machineKey values from any MyLittleAdmin 3.8 installation
2. Using tools like ysoserial.net to generate a malicious serialized payload with a .NET gadget chain
3. Signing the payload with the known machineKey to create a valid ViewState
4. Sending an HTTP request containing the malicious ViewState to any MyLittleAdmin endpoint

The vulnerability is particularly severe because it combines a static cryptographic key with .NET's powerful deserialization capabilities. When the server deserializes the malicious ViewState, it executes the embedded gadget chain, typically resulting in command execution with the privileges of the IIS application pool identity.

Technical details and proof-of-concept information are available in the SSD Advisory and Packet Storm Security Exploit.

Detection Methods for CVE-2020-13166

Indicators of Compromise

• Unusual POST requests to MyLittleAdmin endpoints containing abnormally large or encoded ViewState parameters
• Web server logs showing requests with base64-encoded data in __VIEWSTATE fields that decode to serialized .NET objects
• Unexpected child processes spawned by w3wp.exe (IIS worker process) on servers running MyLittleAdmin
• Evidence of ysoserial.net gadget chains in HTTP request payloads or memory dumps
• Anomalous outbound network connections from web application servers

Detection Strategies

• Deploy web application firewalls (WAF) with rules to detect .NET deserialization attacks and suspicious ViewState patterns
• Monitor IIS logs for requests to MyLittleAdmin endpoints with unusually large POST bodies or ViewState values
• Implement endpoint detection and response (EDR) solutions to identify suspicious process creation from IIS worker processes
• Use SentinelOne Singularity to detect and prevent malicious payload execution resulting from deserialization attacks

Monitoring Recommendations

• Enable detailed IIS logging and monitor for anomalous request patterns to MyLittleAdmin URLs
• Configure alerting on process spawning events from w3wp.exe that don't match normal application behavior
• Audit and monitor changes to web.config files across all MyLittleAdmin installations
• Implement network monitoring to detect command and control traffic that may follow successful exploitation

How to Mitigate CVE-2020-13166

Immediate Actions Required

• Upgrade MyLittleAdmin to the latest version that addresses this vulnerability
• Generate unique, cryptographically secure machineKey values for each installation and update web.config
• Restrict network access to MyLittleAdmin to trusted IP addresses or VPN-only access
• Consider disabling or removing MyLittleAdmin if not actively required
• Implement web application firewall rules to filter malicious ViewState payloads

Patch Information

Organizations should contact MyLittleTools for updated software versions that address this vulnerability. As an immediate mitigation, administrators must replace the hardcoded machineKey with unique, randomly generated values. The new keys should be at least 128 characters for the validation key (using HMACSHA256 or stronger) and 64 characters for the decryption key (using AES256).

Refer to the SSD Advisory for additional technical details regarding the vulnerability.

Workarounds

• Generate and deploy unique machineKey values using the IIS Manager or PowerShell's [System.Web.Security.MachineKey]::GenerateKey() methods
• Implement network segmentation to isolate MyLittleAdmin from direct internet access
• Use IP whitelisting or VPN requirements to restrict access to MyLittleAdmin management interfaces
• Deploy a reverse proxy with request inspection capabilities to filter malicious payloads before they reach the application

# Generate new machineKey values using PowerShell (run on Windows server)
# This generates cryptographically secure keys to replace the hardcoded values

# Generate validation key (64 bytes = 128 hex characters for HMACSHA256)
$validationKey = -join ((1..64) | ForEach-Object { "{0:X2}" -f (Get-Random -Maximum 256) })

# Generate decryption key (32 bytes = 64 hex characters for AES256)
$decryptionKey = -join ((1..32) | ForEach-Object { "{0:X2}" -f (Get-Random -Maximum 256) })

# Output the machineKey element to add to web.config
Write-Host "<machineKey validationKey='$validationKey' decryptionKey='$decryptionKey' validation='HMACSHA256' decryption='AES' />"