MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest naming mysql_clear_password or dialog (PAM) over a plain-TCP unencrypted connection, and AuthenticationFlow permits ClearPasswordPluginFlow or PamPluginFlow to return the user's password as cleartext bytes on the wire.
The disclosed credentials can subsequently be used to authenticate directly to the database server. This issue is fixed in version 1.4.1.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 5
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/commit/be786603e…
security-advisories@github.com
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/releases/tag/1.4…
security-advisories@github.com
https://github.com/mariadb-corporation/mariadb-connector-r2dbc/security/advisor…
security-advisories@github.com
https://hackerone.com/reports/3784556
security-advisories@github.com
https://jira.mariadb.org/browse/R2DBC-115
security-advisories@github.com