<story><title>MySQL client allows MySQL server to request any local file</title><url>https://gwillem.gitlab.io/2019/01/20/sites-hacked-via-mysql-protocal-flaw/</url></story><parent_chain><item><author>sehrope</author><text>The intended usage is that the client tells the server, &amp;quot;&lt;i&gt;I want to load data from a file &amp;#x2F;path&amp;#x2F;to&amp;#x2F;data.txt on my local filesystem&lt;/i&gt;&amp;quot; in a SQL command. As part of the protocol for executing the query the server sends a message to the client to request the contents of &amp;#x2F;path&amp;#x2F;to&amp;#x2F;data.txt. Unfortunately client&amp;#x27;s don&amp;#x27;t validate the file request and will send &lt;i&gt;any&lt;/i&gt; file (ex: &amp;#x2F;path&amp;#x2F;to&amp;#x2F;secrets.txt) even if there was no legit data request in their command.&lt;p&gt;This has been an issue with MySQL client drivers for years. I found and fixed the same issue in MariaDB Connector&amp;#x2F;J (JDBC driver (wire compatible with MySQL databases) in 2015. It rejects LOCAL DATA requests from the server unless the client app preregistered an InputStream (Java interface for generic stream of bytes) as data for the command being executing.&lt;p&gt;This is one of the many &lt;i&gt;many&lt;/i&gt; reasons I love open source database drivers. I was able to find and fix this issue only because I could see the source code. Similar &amp;quot;features&amp;quot; in proprietary databases could go unnoticed for years and even when discovered may not have feature flags to disable them.</text></item></parent_chain><comment><author>xnyhps</author><text>Similarly, MySQL Connector&amp;#x2F;J also used to attempt to deserialize binary data that &lt;i&gt;looked&lt;/i&gt; like a serialized Java object (CVE-2017-3523). Doing this with untrusted data can often be used to obtain arbitrary code execution. Connecting to an untrusted server does not appear to be a use-case that received enough attention.</text></comment>
<story><title>MySQL client allows MySQL server to request any local file</title><url>https://gwillem.gitlab.io/2019/01/20/sites-hacked-via-mysql-protocal-flaw/</url></story><parent_chain><item><author>sehrope</author><text>The intended usage is that the client tells the server, &amp;quot;&lt;i&gt;I want to load data from a file &amp;#x2F;path&amp;#x2F;to&amp;#x2F;data.txt on my local filesystem&lt;/i&gt;&amp;quot; in a SQL command. As part of the protocol for executing the query the server sends a message to the client to request the contents of &amp;#x2F;path&amp;#x2F;to&amp;#x2F;data.txt. Unfortunately client&amp;#x27;s don&amp;#x27;t validate the file request and will send &lt;i&gt;any&lt;/i&gt; file (ex: &amp;#x2F;path&amp;#x2F;to&amp;#x2F;secrets.txt) even if there was no legit data request in their command.&lt;p&gt;This has been an issue with MySQL client drivers for years. I found and fixed the same issue in MariaDB Connector&amp;#x2F;J (JDBC driver (wire compatible with MySQL databases) in 2015. It rejects LOCAL DATA requests from the server unless the client app preregistered an InputStream (Java interface for generic stream of bytes) as data for the command being executing.&lt;p&gt;This is one of the many &lt;i&gt;many&lt;/i&gt; reasons I love open source database drivers. I was able to find and fix this issue only because I could see the source code. Similar &amp;quot;features&amp;quot; in proprietary databases could go unnoticed for years and even when discovered may not have feature flags to disable them.</text></item></parent_chain><comment><author>Illniyar</author><text>This seems like a weird design choice. Why would you need to load a file from the file system as part of a select?&lt;p&gt;Unless I&amp;#x27;m missing some kind of use case this seems like a bad protocol design.</text></comment>