Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive files from your client system to an attacker-controlled MySQL server. Since exploitation requires no privileges or user interaction and can be performed remotely over the network, an attacker can easily exfiltrate arbitrary files, potentially exposing confidential data, credentials, or other sensitive information stored on the client machine. [3, 1]

Useful 0 Not Useful 0

Executive Summary

This vulnerability in the aiomysql Python library allows a malicious MySQL server to trick the client into sending arbitrary local files. Before version 0.3.0, the client did not properly verify or restrict local file access requests from the server. A rogue server can emulate authorization, ignore client flags, and send LOAD_LOCAL instruction packets to retrieve files from the client system without permission. This flaw enables attackers controlling or impersonating a MySQL server to exfiltrate sensitive files from the client machine. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

Detection involves monitoring for unusual LOAD_LOCAL instruction packets sent from your aiomysql client to MySQL servers, especially when connecting to untrusted or unknown servers. Since the vulnerability allows a rogue server to request arbitrary local files, you can inspect network traffic for unexpected LOAD_LOCAL commands or file transfer activity. Additionally, reviewing client logs for unexpected file access or transfers triggered by MySQL connections may help. Specific commands are not provided in the resources, but using network packet capture tools like tcpdump or Wireshark to filter MySQL protocol traffic and searching for LOAD_LOCAL packets can be effective. [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade the aiomysql library to version 0.3.0 or later, where the issue is patched. The fix requires explicitly enabling the local_infile parameter on the client side to allow local file loading, preventing unauthorized file access by rogue servers. Until upgrading, avoid connecting to untrusted MySQL servers and disable any local file loading features if possible. Applying the patch from Pull Request #1044 or equivalent security updates is recommended to enforce proper verification of LOAD_LOCAL requests. [1, 3]

Useful 0 Not Useful 0