MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files

• >= 3.0.0, < 3.3.7

## Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for `LOAD DATA LOCAL INFILE ''`. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later query could satisfy it. A rogue or MitM server can read any file the client JVM can read. ## Details When a server answers a command with a LOCAL INFILE request (`0xFB` packet), the connector opens the named file on the client host and streams it to the server, after verifying that the file corresponds to a `LOAD DATA LOCAL INFILE` of the command it sent (`ClientMessage.validateLocalFileName()`). That verification was a regular expression whose prefix accepted any character, so it answered "does the text appear anywhere in the SQL", including inside a backtick-quoted identifier. Several driver paths put identifiers returned by the server straight back into their next query: `DatabaseMetaData.getImportedKeys()` and `getExportedKeys()` re-use database and table names from `SHOW DATABASES`, `SHOW TABLES` and the `REFERENCES` clause of `SHOW CREATE TABLE` output, and updatable r

GitHub Advisory Database

• >= 3.4.0, < 3.4.5

## Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for `LOAD DATA LOCAL INFILE ''`. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later query could satisfy it. A rogue or MitM server can read any file the client JVM can read. ## Details When a server answers a command with a LOCAL INFILE request (`0xFB` packet), the connector opens the named file on the client host and streams it to the server, after verifying that the file corresponds to a `LOAD DATA LOCAL INFILE` of the command it sent (`ClientMessage.validateLocalFileName()`). That verification was a regular expression whose prefix accepted any character, so it answered "does the text appear anywhere in the SQL", including inside a backtick-quoted identifier. Several driver paths put identifiers returned by the server straight back into their next query: `DatabaseMetaData.getImportedKeys()` and `getExportedKeys()` re-use database and table names from `SHOW DATABASES`, `SHOW TABLES` and the `REFERENCES` clause of `SHOW CREATE TABLE` output, and updatable r

GitHub Advisory Database

• >= 3.5.0, < 3.5.11

## Summary MariaDB Connector/J checked a server's LOAD DATA LOCAL INFILE file request by searching the text of the command it had sent for `LOAD DATA LOCAL INFILE ''`. The search also matched inside quoted identifiers, string literals and comments, so text returned by the server and re-used in a later query could satisfy it. A rogue or MitM server can read any file the client JVM can read. ## Details When a server answers a command with a LOCAL INFILE request (`0xFB` packet), the connector opens the named file on the client host and streams it to the server, after verifying that the file corresponds to a `LOAD DATA LOCAL INFILE` of the command it sent (`ClientMessage.validateLocalFileName()`). That verification was a regular expression whose prefix accepted any character, so it answered "does the text appear anywhere in the SQL", including inside a backtick-quoted identifier. Several driver paths put identifiers returned by the server straight back into their next query: `DatabaseMetaData.getImportedKeys()` and `getExportedKeys()` re-use database and table names from `SHOW DATABASES`, `SHOW TABLES` and the `REFERENCES` clause of `SHOW CREATE TABLE` output, and updatable r

GitHub Advisory Database