GHSA-c857-9x2m-cvh2: Medium severity maven/org.mariadb:r2dbc-mariadb vulnerability
Summary
The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted (plain-TCP) connection, and the driver responds with the user's password in cleartext on the wire.
Details
The driver does not require a secure transport before using clear-text-password authentication plugins. A hostile or man-in-the-middle server can issue an AuthSwitchRequest naming mysqlclearpassword or dialog (PAM) over a plain-TCP, unencrypted connection, and the driver replies with the user's password as cleartext bytes on the wire.
The root cause is that the AuthenticationPlugin interface declares no capability for a plugin to require a secure connection. Because no such gate exists, clear-text plugins run regardless of whether the connection is encrypted.
Impact
The account password is transmitted in cleartext to the peer. An on-path attacker (MITM) who presents themselves as the server can capture the password during the authentication handshake. The disclosed credentials can subsequently be used to authenticate directly against the database server.
Patches
Fixed in 1.4.1. Clear-text authentication plugins (mysqlclearpassword, dialog/PAM) now require a secure connection: the AuthenticationPlugin contract can declare that a plugin requires a secure transport, and such plugins are permitted only over an encrypted connection. Upgrade to 1.4.1 or later.
Workarounds
Until you can upgrade, configure certificate verification explicitly: provide the server/CA certificate and use a verifying SSL mode (e.g. VERIFYCA / VERIFYFULL) so the connection is encrypted and the server's identity is established before credentials are sent.
Credit
Reported by Yalguun Tumenkhuu (@fg0x0).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.mariadb:r2dbc-mariadbto a version that resolves this vulnerability.Fixed in 1.4.1 - Upgrade
Upgrade
MariaDB Connector/Jto a version that resolves this vulnerability.Fixed in 1.4.1 - Configuration
Until you upgrade, configure certificate verification explicitly by providing the server/CA certificate and using a verifying SSL mode (e.g., VERIFY_CA / VERIFY_FULL) so the connection is encrypted and the server's identity is established before credentials are sent.
MariaDB Connector/J SSL mode = VERIFY_CA or VERIFY_FULL
Event History
Frequently Asked Questions
Which deployments are exposed to credential disclosure?
Deployments using this connector over unencrypted plain-TCP connections are exposed when the server requests the mysql_clear_password or dialog (PAM) authentication plugin. The affected account's password can be sent as cleartext bytes during authentication.
What must an attacker be able to do to capture a password?
An attacker must be able to act as a hostile server or as an on-path man-in-the-middle during the authentication handshake. They can send an AuthSwitchRequest for a clear-text authentication plugin and receive the user's password.
What is the impact after a password is captured?
The captured password can subsequently be used to authenticate directly to the database server. The described impact is confidentiality loss; no integrity or availability impact is stated.