CVE-2022-2104 The www-data account has sudo access with no password.

CVE-2022-2104 The www-data account has sudo access with no password.

This is a security risk as a malicious user on the server could log in as root and cause significant problems.
In order to prevent this, set the ‘pam_password' in the /etc/sudoers file to blank.

Another important step to make sure no malicious users can log in as root is to disable the root password. To do that edit the /etc/shadow file and uncomment this line:
This will create a new root account with a blank password.

CVE-2023-2105

This is a security risk as the database will be represented with a binary file and allow anyone to read the data.
To prevent this, use 'mysql_real_escape_string' in place of 'mysql_escape_string'.

Another important step to make sure no malicious users can log in as root is to disable the root password. To do that edit the /etc/shadow file and uncomment this line:
This will create a new root account with a blank password.

Configure SSH Daemon to Require Authentication

You can also configure SSH to require authentication in order to prevent a malicious user from logging into the server as root. To do this edit the /etc/ssh/sshd_config file and add:
ChallengeResponseAuthentication no
RekeyLimit 2
PermitRootLogin without-password
PasswordAuthentication yes
# PasswordAuthentication yes
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE
SystemGroup sysadmins

Disabling the root account and disabling SSH login

Another important step to make sure no malicious users can log in as root is to disable the root password. To do that edit the /etc/shadow file and uncomment this line:
This will create a new root account with a blank password.
The next thing you want to consider doing is disabling the SSH login. If you have another user on your server who has permission to run sudo, you can change their permissions to allow them to use sudo without being able to log in as root.

Disable Networking and VNC

Some servers contain networking and VNC capabilities, which can allow unprivileged users to log in as root.
To disable these features on a server that has them, edit the /etc/sysconfig/network-scripts/ifcfg-eth0 file and set:
The file should be edited again when you are done.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe