Pierluigi Paganini
January 21, 2019
The flaw resides in the file transfer process between a client host and a MySQL server, it could be exploited by an attacker running a rogue MySQL server to access any data that could be read by the client.
The issue ties with the LOAD DATA statement used with the LOCAL modifier. The LOAD DATA statement can load a file located on the server, and if the LOCAL keyword is used in the request, on the client host.
The transfer of the file from the client host to the MySQL server host is initiated by the server.
A client receives file-transfer requests from the MySQL server based on the information it provides in the LOAD DATA statement. A rogue server could send a LOAD DATA LOCAL statement to the client to get access to any file for which the client has read permission.
“In theory, a patched server could be built that would tell the client program to transfer a file of the server’s choosing rather than the file named by the client in the LOAD DATA statement.” reads the official documentation.
“Such a server could access any file on the client host to which the client user has read access.”
Experts pointed out that the issue also affects web servers that acting as clients connect to a MySQL server. In this scenario, an attacker can trigger the vulnerability to steal sensitive files, including
An attacker can get access to a file by knowing its full path, the information that could be obtained using the “/proc/self/environ’ file, which provides the environment variable of the running process.
The attackers
SSH keys,
According to the researchers Willem de Groot, the cybercrime gang known as Magecart exploited the flaw to inject into shopping sites software skimmer in the October 2018 attacks.
It is quite easy for attackers to set up a malicious server by using a code that has been available on GitHub for the past five years.
“
“AFAIK this attack method has not been published before, but in
de Groot speculate that a modified version of the rogue MySQL server is for sale on the dark web.
The expert noticed attackers using Adminer to send the contents of
‘local.xml’ that stores secret database password in Magento installs to the server under their control.
“I have tested Adminer versions 4.3.1 up to 4.6.2 and found all to be vulnerable. Adminer 4.6.3 was released in
“I would recommend anyone running Adminer to upgrade to the latest version (4.7.0). Also, I urge anyone to protect their database tools via an additional password and/or IP filter.”
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – MySQL server, hacking)
[adrotate banner=”5″] [adrotate banner=”13″]
