Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql
Moderate severity
GitHub Reviewed
Published
Jun 29, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Description
Published by the National Vulnerability Database
Jun 28, 2022
Published to the GitHub Advisory Database
Jun 29, 2022
Reviewed
Jul 5, 2022
Last updated
Jan 27, 2023
A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide additional data from a local file readable by the client (and not a "local" file on the server).
References