app/etc/local.xml compromised

[luigifab]

Due to a misconfiguration of the server, we have found that some websites expose their app/etc/local.xml.
What are the consequences? 💣

[kiatng]

Bad actor may gain access to the DB, if that happens, the potential damage is exponentially propotional to the worth of the data.

[tmotyl]

Are you in EU? Then consult your lawyer regarding country specific rules about gdpr. In Poland you have 48h to notify in a formal way the administrator of the personal data of the system (usually the merchant).

[luigifab]

Yes, all owners are informed.

[Flyingmana]

This is exactly the right question to start a risk analyses.
You need to check everything which is noted in the local.xml regarding login and api credentials, and also the backend url.
Use this as base, to check all of them if they would be accessable from the outside, and if the credentials were usable for this.
You need to actually check/try this. "It should not be accessable" is not good enough for the analyses.

Usually the biggest risk here is the backend url, although there are rare cases of misconfigured server setups, which also expose mysql or redis to the web.
Check the Backend logs for unusual logins or activity for since the local.xml was viewable.

[luigifab]

This critical fail of the life concern only tests websites.
The database of theses websites use a copy of production databases without customers and orders/invoices/shipments/refunds...
The sql and redis server are not accessible from internet.

We have changed all users/passwords, and all backend url.
But the local.xml also expose the cypt key, not sure what to think about it.

[Flyingmana]

ahh right, crypt key, you probably should check where it is used for. By default I think only encrypted config settings (so api keys and passwords) are encrypted with it. But that is only relevant if they also got access to the database. Or it leaks somewhen in the future(or past).
When changing it, keep in mind you need to also migrate these settings.

[elidrissidev]

Oh boy! doesn't Magento actually show a warning in the admin panel when it's misconfigured? Pretty sure I saw it before. It happened to us before, some bots were crawling the website looking for configuration files but luckily we had everything configured properly.

[kiatng]

Could be here

https://github.com/OpenMage/magento-lts/blob/1.9.4.x/app/code/core/Mage/Adminhtml/Block/Notification/Security.php

and reference here

magento-lts/app/design/adminhtml/default/default/layout/main.xml

Line 121 in c8a627f

<block type="adminhtml/notification_security" name="notification_security" as="notification_security" template="notification/security.phtml"></block>

and this here show how it can be disabled.

[elidrissidev]

@luigifab can you confirm if the affected installations had this notification visible in the admin?

[luigifab]

I checked, notification is visible.

[addison74]

Is it an Nginx webserver, isn't it? It happens if you don't configure it properly.

1. If the database server port is public and it can be accessed from outside of the network you are in trouble. This is newbie issue MySQL server should run always on localhost. You can expose the port only changed as number for a limited time.
2. Sometimes the authentication information from database are the same with the ones from SSH server. If the SSH is running on the default port it is piece of cake for anyone who knows Linux commands to access the system.
3. If a database management script is installed (e.g. phpMyAdmin) and someone knows the path he will have access to your databases for that user.

Only a stupid hacker reveals his actions like deleting files or changing files. Those who are smart continue staying undercover and grabbing information. If you have root access to that machine you can check the logs. You can check webserver logs who accessed local.xml. I would go further in checking what files were created, accessed, modified in /home/.

[luigifab]

True, it's Nginx. For all your points, for our cases, response is no.