Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

CBS Last.fm Fixes Admin Password Leakage Via Symfony Profiler

CBS Last.fm Fixes Admin Password Leakage Via Symfony Profiler

This week, British music streaming service, Last.fm has fixed a credential leakage issue that revealed admin username and password.

The leak had occurred due to a misconfigured PHP Symfony app running in “debug” mode and exposing profiler logs.

With these credentials, an attacker could have accessed and modified Last.fm user account details.

Last.fm web app ran in “debug” mode

Last week, researchers at SecurityDiscovery.com, Sébastien “Seb” Kaul and Bob Diachenko discovered a web app running in “debug” mode.

The web app belonged to CBS-owned Last.fm, a freemium online music streaming service.

When running in debug mode, apps expose data that should remain hidden from the public view, to make troubleshooting easier for developers.

Diachenko said, the misconfigured Symfony app found by Kaul had been exposing “PHPinfo page and profiler logs with credentials.”

If misused, these leaked credentials would have allowed attackers to query each and every Last.fm user for critical info.

Also Read: The 5 Benefits Of Outsourcing Data Protection Officer Service

phpinfo last.fm symfony php
Symfony app exposed PHP Info page with sensitive debugging info
Source: Twitter

On taking a closer look at the app, the researchers observed the Last.fm‘s Symfony Profiler logs were exposing multiple administrator usernames, passwords, and secret tokens, shown below in a screenshot shared with BleepingComputer.

Last.fm Symfony PHP profiler leaks admin credentials
Last.fm Symfony profiler leaks admin credentials in debug mode
Source: Bob Diachenko

“From what we understood it was part of the admin dashboard, allowing [users] to view and edit Last.fm users’ account info and details,” Diachenko told BleepingComputer.

At the time of our testing, BleepingComputer observed the vulnerable endpoints and the admin dashboard were no longer accessible.

last.fm prism dashboard
Admin Dashboard observed by SecurityDiscovery.com team
Source: Twitter

Researchers spotted leak via IoT search engine

Kaul and Diachenko had spotted Last.fm’s misconfigured web app as a part of their routine research efforts.

“We are now researching misconfigured Sympfony applications and fingerprinting them via IoT search engine(s). The CBSi instances were found as part of this research,” Diachenko told BleepingComputer.

Last week, Diachenko had asked for everyone’s help in identifying the key person at CBS Interactive for reporting this security issue.

BleepingComputer has reached out to both Last.fm and CBS Interactive for comment but we have not heard back yet.

Although the issue appears to have now been remediated, it does set a precedent for when apps are deployed in production environments.

If not hardened properly, an IoT search engine may eventually index the vulnerable endpoints for the world to view.

Also Read: How To Prevent WhatsApp Hack: 7 Best Practices

Earlier this year, hackers behind the ‘Meow’ attack had wiped almost 4,000 MongoDB databases exposed via IoT search engines.

Attackers have also made extortion threats when unsecured systems are discovered in this fashion.

Kaul and Diachenko had spotted Last.fm’s misconfigured web app as a part of their routine research efforts.

“We are now researching misconfigured Sympfony applications and fingerprinting them via IoT search engine(s). The CBSi instances were found as part of this research,” Diachenko told BleepingComputer.

Last week, Diachenko had asked for everyone’s help in identifying the key person at CBS Interactive for reporting this security issue.

BleepingComputer has reached out to both Last.fm and CBS Interactive for comment but we have not heard back yet.

Although the issue appears to have now been remediated, it does set a precedent for when apps are deployed in production environments.

If not hardened properly, an IoT search engine may eventually index the vulnerable endpoints for the world to view.

Earlier this year, hackers behind the ‘Meow’ attack had wiped almost 4,000 MongoDB databases exposed via IoT search engines.

Attackers have also made extortion threats when unsecured systems are discovered in this fashion.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us