5 ms·

I think this is poorly framed as RCE when it's just privilege escalation. The user already needs MySQL login access, shell access, and the ability to upload a m

by feld 10y ago

I think this is poorly framed as RCE when it's just privilege escalation. The user already needs MySQL login access, shell access, and the ability to upload a malicious library that can be added to LD_PRELOAD through a setting in my.cnf. They do propose a trick to overwrite my.cnf with a logging function, but still... This doesn't seem very threatening at all. If you're not already running services with strict file permissions this is the least of your worries. edit: appears shell access isn't required to upload the malicious library, but you still need valid MySQL creds. Just because a SQLi might be there doesn't mean you can upgrade this to "remote code execution". That's just chaining vulns together; it doesn't magically upgrade the severity of this.

bechampion 10y ago
i agree with that .. this isn't remote at all.
- bechampion 10y ago
  maybe a sql injection ....and escalate from there..
- TickleSteve 10y ago
  The point is that it is exploitable from SQL, therefore is also exploitable from the application that is creating the database. This would be a target for a sql injection exploit and so is remotely exploitable
  - whyleyc 10y ago
    That requires your application to be vulnerable to two types of exploit in order to pull off RCE - if you are vulnerable to SQLi there are likely a whole raft of other issues which would give you a remote shell. As a standalone issue I agree with the GP comment - this bug is not a RCE issue, it's privilege escalation.
  - deleted 10y ago
    [deleted]
  - bechampion 10y ago
    I'm sorry I disagree , you're assuming that the "application" is vulnerable to sql injection and others.
- 0x0 10y ago
  Not everyone limits mysql to just localhost. Some setups serve mysql over tcp/ip, sometimes even on the internet. Maybe you wouldn't trust mysql's ssl usage or username/password auth mechanisms, but they are there, and some people use those features. So this should certainly be considered a remote vulnerability, as long as the exploit can be launched from the client side of a mysql connection.
0x0 10y ago
For shared hosting providers, or any configuration where mysql access control is actually used for anything, this appears fairly critical. Especially for the upcoming PoC that doesn't need /etc/mysql/my.cnf to be writable. It also means that an SQLi vulnerability suddenly becomes a potential remote root shell.
- Vendan 10y ago
  If a shared hosting provider is giving you FILE permission, you should close your account and leave, cause they don't understand trivial basics of database security.
_forestfortrees 10y ago
You're arguing authenticated vs unauthenticated remote code execution. Given MySQL creds and a (fairly common) file write primitive (file upload functionality, log injection, etc) that in itself should not qualify as a vulnerability, you can execute remote code on the server with just this vulnerability. I think RCE is a fair description here.
- kilburn 10y ago
  Giving FILE permissions to MySQL users is "fairly common"? Google it and you'll find that the first page of results are all about people complaining that their piece of software did not grant them such permissions by default. Hence, I totally challenge your assertion. This is an important issue to consider, but it has been WAY overblown as presented here. To be perferctly clear: if you are running mysql in your production stack, you are most likely NOT affected by this whole ordeal at all. Now, with the initial panick blown off, please read the article and assess wether you are one of the few affected users out there or not (in short: only worry if you have regular users with the FILE privilege enabled). Spreading FUD doesn't help anybody...
  - _forestfortrees 10y ago
    > Giving FILE permissions to MySQL users is "fairly common"? When... did I say that? I said: a file write primitive on a server is fairly common. e.g. a PHP web app that lets you upload a file to some directory on the server. An attacker could use such a feature to upload a .so file to load into mysqld. I'm just arguing that the title of RCE is accurate here. In a non-trivial amount of configurations you can abuse this vulnerability to remotely compromise a machine you otherwise couldn't get a shell on. Hence RCE.
    - Vendan 10y ago
      If you read it, you'd find you need to be either admin on mysql already(and that's a bad thing), or have FILE permission on mysql. It's not about file upload primitive, the exploit is very specifically about the FILE permission on MYSQL allowing the user to add a new trigger as "root".

by feld 10y ago

bechampion 10y ago

i agree with that .. this isn't remote at all.

bechampion 10y ago
maybe a sql injection ....and escalate from there..
TickleSteve 10y ago
The point is that it is exploitable from SQL, therefore is also exploitable from the application that is creating the database. This would be a target for a sql injection exploit and so is remotely exploitable
- whyleyc 10y ago
  That requires your application to be vulnerable to two types of exploit in order to pull off RCE - if you are vulnerable to SQLi there are likely a whole raft of other issues which would give you a remote shell. As a standalone issue I agree with the GP comment - this bug is not a RCE issue, it's privilege escalation.
- deleted 10y ago
  [deleted]
- bechampion 10y ago
  I'm sorry I disagree , you're assuming that the "application" is vulnerable to sql injection and others.
0x0 10y ago
Not everyone limits mysql to just localhost. Some setups serve mysql over tcp/ip, sometimes even on the internet. Maybe you wouldn't trust mysql's ssl usage or username/password auth mechanisms, but they are there, and some people use those features. So this should certainly be considered a remote vulnerability, as long as the exploit can be launched from the client side of a mysql connection.

0x0 10y ago

For shared hosting providers, or any configuration where mysql access control is actually used for anything, this appears fairly critical. Especially for the upcoming PoC that doesn't need /etc/mysql/my.cnf to be writable. It also means that an SQLi vulnerability suddenly becomes a potential remote root shell.

Vendan 10y ago
If a shared hosting provider is giving you FILE permission, you should close your account and leave, cause they don't understand trivial basics of database security.

_forestfortrees 10y ago

You're arguing authenticated vs unauthenticated remote code execution. Given MySQL creds and a (fairly common) file write primitive (file upload functionality, log injection, etc) that in itself should not qualify as a vulnerability, you can execute remote code on the server with just this vulnerability. I think RCE is a fair description here.

kilburn 10y ago
Giving FILE permissions to MySQL users is "fairly common"? Google it and you'll find that the first page of results are all about people complaining that their piece of software did not grant them such permissions by default. Hence, I totally challenge your assertion. This is an important issue to consider, but it has been WAY overblown as presented here. To be perferctly clear: if you are running mysql in your production stack, you are most likely NOT affected by this whole ordeal at all. Now, with the initial panick blown off, please read the article and assess wether you are one of the few affected users out there or not (in short: only worry if you have regular users with the FILE privilege enabled). Spreading FUD doesn't help anybody...
- _forestfortrees 10y ago
  > Giving FILE permissions to MySQL users is "fairly common"? When... did I say that? I said: a file write primitive on a server is fairly common. e.g. a PHP web app that lets you upload a file to some directory on the server. An attacker could use such a feature to upload a .so file to load into mysqld. I'm just arguing that the title of RCE is accurate here. In a non-trivial amount of configurations you can abuse this vulnerability to remotely compromise a machine you otherwise couldn't get a shell on. Hence RCE.
  - Vendan 10y ago
    If you read it, you'd find you need to be either admin on mysql already(and that's a bad thing), or have FILE permission on mysql. It's not about file upload primitive, the exploit is very specifically about the FILE permission on MYSQL allowing the user to add a new trigger as "root".