0
1
A rogue MySQL server could be used to steal files from clients due to a design flaw in the popular an open source relational database management system (RDBMS).
The flaw resides in the file transfer process between a client host and a MySQL server, it could be exploited by an attacker running a rogue MySQL server to access any data that could be read by the client.
The issue ties with the LOAD DATA statement used with the LOCAL modifier. The LOAD DATA statement can load a file located on the server, and if the LOCAL keyword is used in the request, on the client host.
The transfer of the file from the client host to the MySQL server host is initiated by the server.
A client receives file-transfer requests from the MySQL server based on the information it provides in the LOAD DATA statement. A rogue server could send a LOAD DATA LOCAL statement to the client to get access to any file for which the client has read permission.
“In theory, a patched server could be built that would tell the client program to transfer a file of the server’s choosing rather than the file named by the client in the LOAD DATA statement.” reads the official documentation.
Experts pointed out that the issue also affects web servers that acting as clients connect to a MySQL server. In this scenario, an attacker can trigger the vulnerability to steal sensitive files, including the /etc/passwd file.
An attacker can get access to a file by knowing its full path, the information that could be obtained using the “/proc/self/environ’ file, which provides the environment variable of the running process.
The attackers could exploit the flaw to steal cryptocurrency wallets and
SSH keys,
According to the researchers Willem de Groot, the cybercrime gang known as Magecart exploited the flaw to inject into shopping sites software skimmer in the October 2018 attacks.
It is quite easy for attackers to set up a malicious server by using a code that has been available on GitHub for the past five years.
Adminer is a popular PHP tool to administer MySQL and PostgreSQL databases. However, it can be lured to disclose arbitrary files. Attackers can abuse that to fetch passwords for popular apps such as Magento and WordPress, and gain control of a site’s database. reads a post published by de Groot.
AFAIK this attack method has not been published before, but in hindsight I have observed it being used by different Magecart factions at least since October 2018 (although I didn’t understand what was going on back then). The vulnerability was subsequently used to inject payment skimmers on several high-profile stores (government & multinationals).
Source:https://securityaffairs.co/wordpress/80151/hacking/mysql-design-flaw.html
