MariaDB: a table option became command-line syntax

MariaDB is a database. Its CONNECT engine lets a table read data from outside the database, such as a web service. A table definition can hold an HTTP option, which gives the address of the data. For example, the option might hold https://example.org/data.json.

The affected code can fetch that data by running curl, a command-line program that downloads URLs. The way it starts curl depends on the operating system.

xcurl(http, uri, out_file):
    if '"' in out_file:
        return error("Invalid file name")

    url = http
    if uri is set:
        url = http + "/" + uri

    if on_windows:
        # One string. Nothing checks url.
        line = 'curl "' + url + '" -o "'
             + out_file + '"'
        create_process(line)
    else:
        # Each argument stays separate.
        exec("curl", url, "-o" + out_file)

In the pseudocode, xcurl takes the address from the option. Outside Windows, it calls exec with each argument as a separate value, so no program has to work out where one ends. On Windows, it builds one string, and create_process starts curl with it. Curl then splits that string back into arguments. Spaces separate the arguments, and quotation marks hold an argument together.

So on Windows, the quotation marks around url are the only boundary of the option's value. xcurl checks the file name for a quotation mark, and it does not check url. A table option can hold a quotation mark as plain text. That mark would end the quoted part early, and the rest of the value would be read as more arguments to curl.

MariaDB's advisory calls this argument injection, where input meant as data gets read as more arguments to a program. It says that this lets the user run commands on the server. The failed assumption is that a value is safe because its first reader accepts it. Accepting a value as a valid table option says nothing about how a second program will read it.

The flaw also crosses a permission boundary. A database user can have the right to define tables, and this does not normally include the right to run programs on the server. Here the first right gave the second. The flaw needs Windows, the CONNECT engine with REST support, and a user who can set this table option.

Red Hat gives this flaw 9.9 under CVSS 3.1, and GitHub gives it 6.3 under CVSS 4.0. Red Hat's score treats the effects as reaching beyond the database.

AISLE reports AI-assisted discovery. MariaDB credits its researchers and lists fixed releases: 10.6.26, 10.11.17, 11.4.11, 11.8.7 and 12.3.2.