The flaw resides in the file transfer process between a client host and a MySQL server, it could be exploited by an attacker running a rogue MySQL server to access any data that could be read by the client.
The issue ties with the LOAD DATA statement used with the LOCAL modifier. The LOAD DATA statement can load a file located on the server, and if the LOCAL keyword is used in the request, on the client host.
The transfer of the file from the client host to the MySQL server host is initiated by the server.
A client receives file-transfer requests from the MySQL server based on the information it provides in the LOAD DATA statement. A rogue server could send a LOAD DATA LOCAL statement to the client to get access to any file for which the client has read permission.
“In theory, a patched server could be built that would tell the client program to transfer a file of the server’s choosing rather than the file named by the client in the LOAD DATA statement.” reads the official documentation.
“Such a server could access any file on the client host to which the client user has read access.”
Experts pointed out that the issue also affects web servers that acting as clients connect to a MySQL server. In this scenario, an attacker can trigger the vulnerability to steal sensitive files, including
An attacker can get access to a file by knowing its full path, the information that could be obtained using the “/proc/self/environ’ file, which provides the environment variable of the running process.
It is quite easy for attackers to set up a malicious server by using a code that has been available on GitHub for the past five years.
“AFAIK this attack method has not been published before, but in
de Groot speculate that a modified version of the rogue MySQL server is for sale on the dark web.
The expert noticed attackers using Adminer to send the contents of
‘local.xml’ that stores secret database password in Magento installs to the server under their control.
“I have tested Adminer versions 4.3.1 up to 4.6.2 and found all to be vulnerable. Adminer 4.6.3 was released in
“I would recommend anyone running Adminer to upgrade to the latest version (4.7.0). Also, I urge anyone to protect their database tools via an additional password and/or IP filter.”
(SecurityAffairs – MySQL server, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.