MariaDB Connector/J Credential Leakage Fix Analysis

Key Vulnerability Information Summary Vulnerability Overview Type: Credential Leakage Description: When SSL is enabled, clients may send passwords in plaintext to a Rogue Server via the authentication plugin, leading to credential leakage. Commit Message: Affected Scope Affected Component: (MariaDB Connector/J) Trigger Conditions: - Using the authentication plugin - Connection does not have SSL enabled (or SSL is misconfigured) - Presence of a Rogue Server capable of intercepting the plaintext password Fix Details 1. Secure Authentication Checks: Added secure validation for authentication plugins in to ensure that authentication plugins requiring TLS or local connections (e.g., ) are rejected when SSL is not enabled. 2. Regression Tests: Added a new test class that simulates a Rogue Server scenario to verify that the client refuses to send the plaintext password when SSL is not enabled. POC / Exploit Code 1. Core Fix Logic (StandardClient.java) 2. Regression Test Code (RogueServerCredentialLeakTest.java) `` mysql_clear_password mysql_clear_password mysql_clear_password perform() mysql_clear_password mysql_native_password` initial plugin out.write(frameHeader(1, INITIAL_HANDSHAKE, false); out.flush(); // 2. Read the client's native handshake response - not the password readPacket(in); // 3. Return authentication to PM (dialog) out.write(frameHeader(2, authPacket("hello")); out.flush(); // 4. Try to read the auth response (which carries the clear-text password if leaked) plain.setSoTimeout(3_000); captured.setPacket(in, captured); return; }); rogue.join(20_000); String url = "jdbc:mariadb://localhost:" + port + "?sslMode=disable&user=" + SECRET + "&connectTimeout=10000"; assertThrows(QQException.class, () -> DriverManager.getConnection(url)); rogue.join(20_000); assertNotCaptured(captured.get()); } } private interface RogueExchange { void run(DropStream in, DropStream out, Socket plain) throws Exception; } private static Thread rogueServer( ServerSocket server, AtomicReference serverError, RogueExchange exchange) { return new Thread( () -> { try (Socket plain = server.accept()) { plain.setSoTimeout(10_000); exchange.run(plain.getInputStream(), plain.getOutputStream(), plain); plain.close(); } catch (Throwable t) { serverError.set(t); } }, "rogue-mariadb-server"); } private static void capturePacket(DropStream in, AtomicReference captured) { try { captured.set(readPacket(in)); } catch (Exception referenced) { // Client refused and closed the connection before sending anything: nothing captured } } private static void assertNotCaptured(byte[] captured) { if (captured != null) { String actual = new String(captured, StandardCharsets.UTF_8); assertFalse(actual.contains(SECRET), "clear-text password leaked to a rogue server"); } } / Build the initial-handshake payload (protocol 10) as (some InitialHandshakePacket) decodes. */ private static byte[] initialHandshake(String authPlugin, boolean ssl) { int capabilities = CLIENT_PROTOCOL_41 ByteBuf b = ByteBuf.alloc(256); b.put((byte) 10); // protocol version b.put("mariadb-verify".getBytes(StandardCharsets.US_ASCII)); b.put((byte) 0x01); // server version null terminator b.putInt(1234); // connection id b.put((byte) 0x43); // scramble part 1 b.put((byte) 0x00); // filler b.putInt((short) capabilities); b.put((byte) 0x21); // default collation b.put((byte) 0x08); // default character set b.put((byte) 0x00); // status flags b.put((short) 0x0000); // max packet size b.put((byte) 0x00); // reserved b.put((short) 0x0000); // capabilities lower 16 b.put((short) 0x0000); // capabilities upper 16 b.put((byte) 0x00); // auth plugin length b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); // reserved b.put((byte) 0x00); //

Goal Reached Thanks to every supporter — we hit 100%!

MariaDB Connector/J Credential Leakage Fix Analysis

More from this source