MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`.
When the `wsrep_notify_cmd` option is enabled, the MariaDB server executes the configured shell command to notify about Galera cluster events. The vulnerability exists because the joiner node name is inserted into the shell call without proper sanitization. An attacker can place malicious shell commands in the node name, which will be executed by the server when the node joins the cluster.
An attacker can execute arbitrary system commands with the privileges of the MariaDB server process, which in practice means complete control over the system — data theft, malware installation, and breach of confidentiality, integrity, and availability of the environment.
Update MariaDB to version: 10.6.27, 10.11.18, 11.4.12, 11.8.8, or 12.3.2. As a temporary workaround, if an update is not immediately possible, disable the `wsrep_notify_cmd` option in the server configuration.
MariaDB Server in versions: 10.6.1–10.6.26, 10.11.1–10.11.17, 11.4.1–11.4.11, 11.8.1–11.8.7, and 12.3.1 — only when the `wsrep_notify_cmd` option is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HMariaDB
APPMariadb12.3.110.6.1 – 10.6.27 (excl.)10.11.1 – 10.11.18 (excl.)11.4.1 – 11.4.12 (excl.)11.8.1 – 11.8.8 (excl.)
Related vulnerabilities
MariaDB v10.5 — RCE przez UDF w plikach współdzielonych (disputed)
Command injection w MariaDB mysql-wsrep via wsrep_sst_method
Błąd w funkcji crc32_big w zlib 1.2.8 — nieokreślony wpływ na system
RCE z uprawnieniami root w Oracle MySQL, MariaDB i Percona Server
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 ...