MySQL Authentication Bypass Vulnerability (CVE-2012-2122)

When connecting to MariaDB/MySQL, the entered password is compared with the expected correct password. Due to improper handling, even if memcmp() returns a non-zero value, MySQL may still consider the two passwords as identical. That is, as long as you know the username, you can directly log into the SQL database by continuous attempts.

Affected versions:

• MariaDB versions before 5.1.62, 5.2.12, 5.3.6, 5.5.23 are not affected.
• MySQL versions before 5.1.63, 5.5.24, 5.6.6 are not affected.

Reference links:

• http://www.freebuf.com/vuls/3815.html
• https://blog.rapid7.com/2012/06/11/cve-2012-2122-a-tragically-comedic-security-flaw-in-mysql/

Environment Setup

Tests have shown that although this environment runs inside a container, whether the vulnerability can be reproduced still has a certain relationship with the host machine. It is best to choose Ubuntu or Mac as the host system, but it is uncertain whether it will always succeed. More test results are welcome in Issues.

Execute the following command to start the test environment:

docker-compose up -d

After the environment starts, a MySQL service (version: 5.5.23) will be launched, listening on port 3306. You can log in directly with a normal MySQL client; the correct root password is 123456.

Vulnerability Verification

Without knowing the correct password for our environment, run the following command in bash; after a certain number of attempts, you can log in successfully:

for i in `seq 1 1000`; do mysql -uroot -pwrong -h your-ip -P3306 ; done

For more testing and exploitation methods, see the reference links.