CVE-2017-15367
📋 TL;DR
CVE-2017-15367 is a critical SQL injection vulnerability in Bacula-web versions before 8.0.0-rc2 that allows attackers to execute arbitrary SQL queries against the Bacula database. This could lead to unauthorized data access, privilege escalation, and potentially full server compromise depending on database configuration. All organizations running vulnerable Bacula-web installations are affected.
💻 Affected Systems
- Bacula-web
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation to root/system access, and potential lateral movement within the network.
Likely Case
Unauthorized access to backup data, modification of backup records, and potential credential theft from the Bacula database.
If Mitigated
Limited to read-only database access if proper database permissions are configured, with no privilege escalation path.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB (ID: 44272). Authentication to Bacula-web is required, but SQL injection can bypass authorization checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0.0-rc2 and later
Vendor Advisory: http://bacula-web.org/download/articles/bacula-web-8-0-0-rc2.html
Restart Required: No
Instructions:
1. Backup current configuration. 2. Download Bacula-web 8.0.0-rc2 or later from official site. 3. Replace existing installation with patched version. 4. Verify database connectivity. 5. Test application functionality.
🔧 Temporary Workarounds
Database Permission Restriction
allLimit database user permissions to read-only access for Bacula-web application account
GRANT SELECT ON bacula.* TO 'bacula_web_user'@'localhost';
REVOKE INSERT, UPDATE, DELETE, DROP, CREATE, ALTER ON bacula.* FROM 'bacula_web_user'@'localhost';
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting Bacula-web endpoints
🧯 If You Can't Patch
- Isolate Bacula-web server from internet and restrict network access to authorized administrators only
- Implement strict database account permissions with minimal privileges required for Bacula-web functionality
🔍 How to Verify
Check if Vulnerable:
Check Bacula-web version in web interface or configuration files. If version is below 8.0.0-rc2, system is vulnerable.Check Version:
grep '\$version' /path/to/bacula-web/include/config.inc.php 2>/dev/null || cat /path/to/bacula-web/VERSION 2>/dev/nullVerify Fix Applied:
Verify version is 8.0.0-rc2 or higher and test SQL injection payloads no longer work.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by complex URL parameters
- Web server logs showing SQL keywords in GET/POST parameters
Network Indicators:
- HTTP requests containing SQL injection patterns to Bacula-web endpoints
- Unusual database connections from web server IP
SIEM Query:
source="web_logs" AND (url="*bacula-web*" AND (param="*UNION*" OR param="*SELECT*" OR param="*INSERT*" OR param="*DELETE*" OR param="*' OR '1'='1*"))🔗 References
- http://bacula-web.org/download/articles/bacula-web-8-0-0-rc2.html
- http://bugs.bacula-web.org/view.php?id=211
- https://github.com/bacula-web/bacula-web/commit/90d4c44a0dd0d65c6fb3ab2417b83d700c8413ae
- https://www.exploit-db.com/exploits/44272/
- http://bacula-web.org/download/articles/bacula-web-8-0-0-rc2.html
- http://bugs.bacula-web.org/view.php?id=211
- https://github.com/bacula-web/bacula-web/commit/90d4c44a0dd0d65c6fb3ab2417b83d700c8413ae
- https://www.exploit-db.com/exploits/44272/
