DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs_priv causing privilege escalation
访问控制 / 访问控制缺陷(通用) / #3908943
该报告还没有中文解读。
原文摘录
摘自原文(6491 字符中的一小部分)
`DROP PACKAGE` removes both `mysql.proc` rows but only the `PACKAGE` row from `mysql.procs_priv`, leaving the `PACKAGE BODY` grant orphaned. Since `PACKAGE BODY` is the type that gates execution, a package later created under the same name is executable by the old grantee without any grant on it, …
原文中的代码
=== grants before drops === Routine_name Routine_type c_func FUNCTION c_pkg PACKAGE BODY c_pkgbody PACKAGE BODY c_proc PROCEDURE === grants after drops === Routine_name Routine_type Proc_priv c_pkg PACKAGE BODY Execute
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 MariaDB 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @heyoimjeb · 版权归作者与 MariaDB 所有