Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-qqh2-wvmv-h72m

HighCVSS 7.5 / 10
Published Sep 12, 2023·Last modified Feb 16, 2024
Affected Components(0)

No affected components available

Description

Summary

An arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._

Details

Hi,Team, i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can read the file on the server. There are some differences in utilization depending on the version of the mysql-connector dependency on the server side.

  1. mysql-connector-java version > 8.14 The default value of allowLoadLocalInfile on the server side is false in this case.We need to manually set this value to true in the connection string.
    Since the way to get the databaseurl in com/google/refine/extension/database/mysql/MySQLConnectionManager.java is to splice the individual configurations directly, we can set the allowLoadLocalInfile parameter after the other parameters(for example the databaseName parameter ).
    image
    image image
  2. mysql-connector-java version <= 8.14 The default value of allowLoadLocalInfile on the server side is true in this case.so wo don't need do anything,Just connect to our malicious server.

PoC

env:
centos 7 openrefine 3.7.4 jdk11 mysql-connector-java version 8.30.0

you can use the tool https://github.com/4ra1n/mysql-fake-server to running a malicious mysql server.
image
for example,to read the /etc/passwd file. image set the username to base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q= and Database name to test?allowLoadLocalInfile=true# (for mysql-connector-java version <= 8.14,just setting the database name normally) and test to connect your malicious mysql server. you can get the file in your fake-server-files directory. image

Impact

An arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._

Risk Scores
Base Score
7.5

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker does not need any special privileges or access rights. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information.

Threat Intelligence
6.9

Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.

EPSS
0.83%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

High severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard