Statcounter Update.sh Vulnerability Fixes Statcounter Update.sh漏洞补丁

Gianni Amato found a vulnerability in statcounter that can expose ip2location database log and account credentials. 意大利 阿马托发现了漏洞statcounter ，可以揭露ip2location数据库日志和帐户凭据。

The Vulnerability弱点

The vulnerability exists in statcounters backup log inside utils directory where the file update.sh reside.该漏洞存在于statcounters备份日志内utils目录下的文件update.sh居住。

• googlecache: *.statcounter.com/utils/update.sh googlecache ： *. statcounter.com / utils / update.sh

Excerpt from Giani Amot:摘自吉亚尼阿莫特：

The server where the backup’s log of the last three days are situated is badly set.该服务器的备份的日志最后三天正处于急需一套。 The access for all directory by server is free, include “utils” directory that contains one script file called “update.sh” inside of which are situated the user and password to enter and download the database log from ip2location.com访问的所有目录服务器是免费的，包括“ utils ”目录，包含一个脚本文件名为“ update.sh ”里面的是位于用户和密码，输入并下载数据库日志从ip2location.com

Update.sh

 cd /home/ip2location的CD / home/ip2location 

 /usr/bin/curl --data 'login=webmaster@statcounter.com&password=kOFr3VTh' 'http://www.ip2location.com/download.aspx?productcode=db6bin' > /home/ip2location/ipdb_current.bin.zip是/ usr /斌/曲-数据'登录= w ebmaster@statcounter.com和密码= k OFr3VTh' ' h ttp://www.ip2location.com/download.aspx?productcode=db6bin“ > / h ome/ip2location/ipdb_current.bin.zip 

 rm /home/ip2location/ipdb_new.bin删除/ home/ip2location/ipdb_new.bin 

 unzip -p /home/ip2location/ipdb_current.bin.zip *.BIN > /home/ip2location/ipdb_new.bin解一p / home/ip2location/ipdb_current.bin.zip *.宾“ / home/ip2location/ipdb_new.bin 

 if [ "$?"如果[ “ $ ？ ” -ne "0" ]; then碱“ 0 ” ] ;然后 

  echo "Sorry, new ip_db archive isn't valid!"回声“对不起，新ip_db存档是无效的！ ” 

  exit 1 1号出口 

 fi科幻 

 mv /home/ip2location/ipdb_new.bin /home/ip2location/ipdb.bin机动车辆/ home/ip2location/ipdb_new.bin / home/ip2location/ipdb.bin 

 rm /home/ip2location/ipdb_current.bin.zip删除/ home/ip2location/ipdb_current.bin.zip 

 /bin/cp /home/ip2location/ipdb.bin /mnt/rd/ipdb.bin /斌/蛋白/ home/ip2location/ipdb.bin /破伤风/次/ ipdb.bin 

htaccess workaround htaccess替代

places the following .htaccess code inside statscounter /utils/ directory下面的地方。 htaccess代码statscounter / utils /目录

 #deny access to any file with *.sh filetypes ＃拒绝存取任何文件， *.上海文件类型 
 <Files ~ "^\.sh"> <Files 〜 "^\.sh"> 
  Order allow,deny为了允许，否认 
  Deny from all拒绝所有 
  Satisfy All满足所有 
 </Files> “ /档案” 

 #Deny request for *.log & comment files ＃拒绝请求*.日志和评论的文件 
 <Files ~ "^.*\.([Ll][Oo][Gg]|[cC][oO][mM][mM][eE][nN][tT])"> <Files 〜 "^.*\.([Ll][Oo][Gg]|[cC][oO][mM][mM][eE][nN][tT])"> 
  Order allow,deny为了允许，否认 
  Deny from all拒绝所有 
  Satisfy All满足所有 
 </Files> “ /档案” 

password protected directories密码保护目录

 AuthType Basic AuthType基本法 
 AuthName "restricted area" AuthName “禁区” 
 AuthUserFile /usr/local/etc/.htpasswd-allusers AuthUserFile的/ usr / local的/ etc / .htpasswd - allusers 
 require valid-user需要有效的用户 

Note: You will need to change the AuthUserFile password file location depending on your server configurations.注意：您将需要改变AuthUserFile密码文件的位置取决于您的服务器配置。

External Resources外部资源

• Giani Amato → Se fossi tu a monitorare Statcounter.com? 吉亚尼阿马托→硒fossi图1 monitorare Statcounter.com ？
• Giani Amato → Se fossi tu a monitorare Statcounter.com » English Translations 吉亚尼阿马托→硒fossi图1 monitorare Statcounter.com »英语翻译