Maven · org.mariadb.jdbc:mariadb-java-client
MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests
MariaDB Connector/J does not enforce allowLocalInfile=false when
processing server-initiated LOCAL INFILE requests (protocol packet
type 0xfb). However, exploitation is constrained: the server can
only request the exact filename the client already included in its
LOAD DATA LOCAL INFILE query, it cannot redirect to arbitrary paths.
When a client executes LOAD DATA LOCAL INFILE '/path/to/file', the
connector sends the filename to the server as part of the COM_QUERY.
A rogue or MitM server responds with a 0xfb packet echoing that
same filename. The connector, without checking allowLocalInfile,
transmits the file content.
The bypass is therefore limited to the file the application itself
intended to load. The attacker cannot escalate to other files
(e.g. /etc/passwd) unless the application's own query targets them.
The real-world risk is:
LOAD DATA LOCAL INFILE on potentially
sensitive files (credentials, exports, configs) and connects over
an untrusted network.allowLocalInfile=false is supposed to disable this entire
mechanism as a defense-in-depth measure, but the flag is ignored.The security guarantee of allowLocalInfile=false is not upheld,
but practical exploitation requires both a MitM/rogue server and an
application that actively uses LOCAL INFILE on sensitive data.
Reported by tharavel
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.