{"uuid": "fb58432c-dc50-4729-9330-e438c8d880c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36193", "type": "seen", "source": "https://t.me/hacking_Attack/48767", "content": "Black Hat Ethical Hacking\nSupply chain flaws in PHP package manager PEAR lay undiscovered for 15 years\n\nSupply chain flaws in PHP package manager PEAR lay undiscovered for 15 yearsPost Views: 3 \nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png Advanced Enumeration techniques with NMAP, Zenmap and Hydra\n\nSubscribe to Patreon to watch this episode.\nReading Time: 2 Minutes\nAttackers could have wreaked havoc on the PHP ecosystem by exploiting a pair of longstanding vulnerabilities that were only recently patched in package manager PEAR.\nPEAR developer accounts were left at risk of malicious takeover by a flaw arising from weak entropy on the password reset function, revealed Thomas Chauchefoin, a vulnerability researcher at Swiss security firm SonarSource, in a blog post.\n\nAttackers could then poison the PHP\u00a0ecosystem with malicious releases of existing packages, before securing persistent access to the central PEAR server via abuse of a separate vulnerability in an outdated version of a bundled dependency.\n\nSonarSource has published a video\u00a0explaining the two-pronged attack scenario.\nSee Also: Complete Offensive Security and Ethical Hacking Course\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png \u2018Minimal technical expertise\u2019PEAR has fallen out of favor amid the rise to dominance of rival PHP package manager Composer, in whose principal repository SonarSource disclosed a similarly serious vulnerability\u00a0last year.\n\nHowever, the most popular packages downloaded via PEAR \u2013 the PEAR client itself, Console_Getopt, Archive_Tar, and Mail \u2013 still rack up several thousand downloads per month.\n\nThe supply chain vulnerabilities, which lay undiscovered for more than 15 years, \u201ccould have been easily identified and exploited by threat actors with only minimal technical expertise, causing important disruption and security breaches across the world\u201d, according to Chauchefoin.\n\nSoftware supply chain attacks targeting PEAR and similar developer tools have a particularly significant impact given developers \u201care likely to run it on their computers before deploying it on production servers, creating an opportunity for attackers to pivot into companies\u2019 internal network\u201d, he added. Weak PRNGPEAR\u2019s password reset function used mt_rand()\u00a0to generate random values, even though the technique is obsolete and unsuitable\u00a0for generating cryptographically secure values.\n\nOnce the values were concatenated and hashed with md5(), \u201cthe final value is only based on two unknowns, which are the output of mt_rand()\u00a0and time(),\u201d said Chauchefoin.\n\n\u201cThe first one cannot yield many values (10), and the second one can easily be approximated by the attacker. In addition, the HTTP server of pear.php.net adds a Date header to its responses, narrowing it down to only a few values (< 5).\u201d\n\nThe researchers concluded that attackers could secure a valid password reset token within 50 attempts.\nSee Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The other bug provided a backdoor for continuing attacks even if the first bug had been fixed. \u201cIt could also help them to hide their tracks by modifying access logs,\u201d said Chauchefoin.\n\nThe flaw arose because pearweb pulled version 1.4.7 of Archive_Tar, which was vulnerable to CVE-2020-36193, a directory traversal\u00a0issue that could lead to remote code execution (RCE) on PEAR. TimelineSonarSource warned the maintainers of PEAR about the bugs on July 30, 2021.\n\nThey were patched in pearweb version 1.32, released on March 13, with all previous versions affected.\n\nThe flaws\u2019 survival in PEAR\u2019s codebase for more than 15 years raises \u201cquestions about the lack of security contrib[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:47.963821Z"}