Uploaded image for project: 'MariaDB Connector/R2DBC'
  1. MariaDB Connector/R2DBC
  2. R2DBC-115

Cleartext password leak for MiTm server

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Fixed
    • None
    • 1.4.1
    • other
    • None

    Description

      The driver does not gate cleartext-password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can issue an AuthSwitchRequest naming mysql_clear_password or dialog over a plain-TCP (unencrypted) connection, and the driver replies with the user's password in cleartext bytes on the wire.

      The AuthenticationPlugin interface declares no capability to require secure connection like JDBC connector does.

      report by fg0x0 in https://hackerone.com/reports/3784556

      Attachments

        Activity

          People

            diego dupin Diego Dupin
            diego dupin Diego Dupin
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.