Pierluigi Paganini January 21, 2019

A rogue MySQL server could be used to steal files from clients due to a design flaw in the popular an open source relational database management system (RDBMS).

The flaw resides in the file transfer process between a client host and a MySQL server, it could be exploited by an attacker running a rogue MySQL server to access any data that could be read by the client.

The issue ties with the LOAD DATA statement used with the LOCAL modifier. The LOAD DATA statement can load a file located on the server, and if the LOCAL keyword is used in the request, on the client host.

The transfer of the file from the client host to the MySQL server host is initiated by the server.

A client receives file-transfer requests from the MySQL server based on the information it provides in the LOAD DATA statement. A rogue server could send a LOAD DATA LOCAL statement to the client to get access to any file for which the client has read permission.

“In theory, a patched server could be built that would tell the client program to transfer a file of the server’s choosing rather than the file named by the client in the LOAD DATA statement.” reads the official documentation.

“Such a server could access any file on the client host to which the client user has read access.”

Experts pointed out that the issue also affects web servers that acting as clients connect to a MySQL server. In this scenario, an attacker can trigger the vulnerability to steal sensitive files, including the /etc/passwd file.

An attacker can get access to a file by knowing its full path, the information that could be obtained using the “/proc/self/environ’ file, which provides the environment variable of the running process.

The attackers could exploit the flaw to steal cryptocurrency wallets and
SSH keys,

According to the researchers Willem de Groot, the cybercrime gang known as Magecart exploited the flaw to inject into shopping sites software skimmer in the October 2018 attacks.

It is quite easy for attackers to set up a malicious server by using a code that has been available on GitHub for the past five years.

“Adminer is a popular PHP tool to administer MySQL and PostgreSQL databases. However, it can be lured to disclose arbitrary files. Attackers can abuse that to fetch passwords for popular apps such as Magento and WordPress, and gain control of a site’s database. ” reads a post published by de Groot.

“AFAIK this attack method has not been published before, but in hindsight I have observed it being used by different Magecart factions at least since October 2018 (although I didn’t understand what was going on back then). The vulnerability was subsequently used to inject payment skimmers on several high-profile stores (government & multinationals).”

de Groot speculate that a modified version of the rogue MySQL server is for sale on the dark web.

The expert noticed attackers using Adminer to send the contents of
‘local.xml’ that stores secret database password in Magento installs to the server under their control.

“I have tested Adminer versions 4.3.1 up to 4.6.2 and found all to be vulnerable. Adminer 4.6.3 was released in June, 2018 and appears safe. It is unclear whether the security flaw was fixed deliberately or by accident, as Adminer does not mention a security release.” added the expert.

“I would recommend anyone running Adminer to upgrade to the latest version (4.7.0). Also, I urge anyone to protect their database tools via an additional password and/or IP filter.”

Pierluigi Paganini

(SecurityAffairs – MySQL server, hacking)

[adrotate banner=”5″] [adrotate banner=”13″]