GHSA-9f6r-vjc7-jq67: blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose
blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQLALLOWEMPTYPASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker host on port 3306 can log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
blueprintUE Self-Hosted Editionto a version that resolves this vulnerability.Fixed in 4.3.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Self-hosted deployments using the affected Docker Compose examples are exposed when MariaDB port 3306 is reachable from an attacker. The examples enable an empty MariaDB root password and publish the database port.
What does an attacker need to exploit this?
An attacker only needs network access to the Docker host on port 3306. No MariaDB credentials or prior access are required because the root account can be accessed without a password.
What can an attacker do after connecting?
An attacker can log in as the MariaDB root user and read, modify, or delete user accounts, blueprints, and all databases.
What can be done if updating is not immediately possible?
Prevent untrusted access to port 3306 and remove the empty-password configuration. Ensure the MariaDB root account has a password rather than allowing empty passwords.