Dr.-Ing. Mario Heiderich, Cure53 Bielefelder Str. 14 D 10709 Berlin cure53.de · mario@cure53.de Pentest-Report Vitess 02.2019 Cure53, Dr.-Ing. M. Heiderich, M. Wege, MSc project was carried out by Cure53 in February 2019 and revealed only three miscellaneous findings. In terms of resources, the test was completed by six members of the Cure53 team who worked within a time setup was requested by the testers and provided by the development team. Besides furnishing Cure53 with a Kubernetes-based cluster, locally installed systems were also used for testing. Access to all

Navigation panel setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 4.6 Main panel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . when splitting up tables by the above separator. $cfg['NumRecentTables'] 4.5. Navigation panel setup 53 phpMyAdmin Documentation, Release 4.7.0 Type integer Default value 10 The maximum number of recently ’], 61 $cfg[’Export’][’method’], 61 $cfg[’FilterLanguages’], 64 $cfg[’FirstLevelNavigationItems’], 53 $cfg[’ForceSSL’], 49 $cfg[’ForeignKeyDropdownOrder’], 60 $cfg[’ForeignKeyMaxLimit’], 60, 125 $cfg[’GD2Available’]

dropping rather than strict privilege limitation. $cfg['Confirm'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 4.9.0.1 Default value true Whether a warning (“Are your really $cfg[’AllowArbitraryServer’], 9, 20, 55 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 55 $cfg[’AuthLog’], 27, 30, 31 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] 72 $cfg[’CheckConfigurationPermissions’], 69 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 64, 123 $cfg[’Confirm’], 53 $cfg[’Console’][’AlwaysExpand’], 78 $cfg[’Console’][’CurrentQuery’], 78 $

dropping rather than strict privilege limitation. $cfg['Confirm'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 5.0.5-dev Default value true Whether a warning (“Are your really $cfg[’AllowArbitraryServer’], 9, 20, 55 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 55 $cfg[’AuthLog’], 27, 30, 31 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] 72 $cfg[’CheckConfigurationPermissions’], 69 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 64, 123 $cfg[’Confirm’], 53 $cfg[’Console’][’AlwaysExpand’], 79 $cfg[’Console’][’CurrentQuery’], 79 $

dropping rather than strict privilege limitation. $cfg['Confirm'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 5.0.0 Default value true Whether a warning (“Are your really sure $cfg[’AllowArbitraryServer’], 9, 20, 55 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 55 $cfg[’AuthLog’], 27, 30, 31 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] 72 $cfg[’CheckConfigurationPermissions’], 69 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 64, 123 $cfg[’Confirm’], 53 $cfg[’Console’][’AlwaysExpand’], 79 $cfg[’Console’][’CurrentQuery’], 79 $

dropping rather than strict privilege limitation. $cfg['Confirm'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 4.8.5 Default value true Whether a warning (“Are your really sure $cfg[’AllowArbitraryServer’], 9, 20, 55 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 55 $cfg[’AuthLog’], 27, 30, 31 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] 71 $cfg[’CheckConfigurationPermissions’], 69 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 64, 119 $cfg[’Confirm’], 53 $cfg[’Console’][’AlwaysExpand’], 78 $cfg[’Console’][’CurrentQuery’], 78 $

dropping rather than strict privilege limitation. $cfg['Confirm'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 4.9.7 Default value true Whether a warning (“Are your really sure $cfg[’AllowArbitraryServer’], 9, 20, 55 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 55 $cfg[’AuthLog’], 27, 30, 31 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] 72 $cfg[’CheckConfigurationPermissions’], 69 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 64, 123 $cfg[’Confirm’], 53 $cfg[’Console’][’AlwaysExpand’], 78 $cfg[’Console’][’CurrentQuery’], 78 $

variable FOREIGN_KEY_CHECKS is used. $cfg['AllowUserDropDatabase'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 5.1.0 Default value false Warning: This is not a security measure $cfg[’AllowArbitraryServer’], 9, 20, 55, 56 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 56 $cfg[’AuthLog’], 27, 30 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] $cfg[’CharTextareaRows’], 74 $cfg[’CheckConfigurationPermissions’], 71 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 66, 125 $cfg[’Confirm’], 54 $cfg[’Console’][’AlwaysExpand’], 80 $cfg[’Conso

dropping rather than strict privilege limitation. $cfg['Confirm'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 5.0.4 Default value true Whether a warning (“Are your really sure $cfg[’AllowArbitraryServer’], 9, 20, 55 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 55 $cfg[’AuthLog’], 27, 30, 31 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] 72 $cfg[’CheckConfigurationPermissions’], 69 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 64, 123 $cfg[’Confirm’], 53 $cfg[’Console’][’AlwaysExpand’], 79 $cfg[’Console’][’CurrentQuery’], 79 $

dropping rather than strict privilege limitation. $cfg['Confirm'] Type boolean 4.3. Generic settings 53 phpMyAdmin Documentation, Release 4.9.1 Default value true Whether a warning (“Are your really sure $cfg[’AllowArbitraryServer’], 9, 20, 55 $cfg[’AllowThirdPartyFraming’], 32 $cfg[’AllowUserDropDatabase’], 53 $cfg[’ArbitraryServerRegexp’], 55 $cfg[’AuthLog’], 27, 30, 31 $cfg[’AuthLogSuccess’], 30 $cfg[’AvailableCharsets’] 72 $cfg[’CheckConfigurationPermissions’], 69 $cfg[’CodemirrorEnable’], 53 $cfg[’CompressOnFly’], 64, 123 $cfg[’Confirm’], 53 $cfg[’Console’][’AlwaysExpand’], 78 $cfg[’Console’][’CurrentQuery’], 78 $