Summary
MariaDB's partition conversion operation can use user-supplied partition names to construct filesystem paths without applying the required filename encoding. An authenticated database user may be able to access or modify table files they are not authorized to use when a partition name requires escaping.
MariaDB's partition conversion operation can use user-supplied partition names to construct filesystem paths without applying the required filename encoding. An authenticated database user may be able to access or modify table files they are not authorized to use when a partition name requires escaping.
Affected context
The issue occurs in MariaDB Server when ALTER TABLE ... CONVERT ... PARTITION processes user-specified partition names and constructs filesystem paths from them. Risk depends on the operation being available to an authenticated user and on the supplied name requiring filename escaping. The vulnerability affects MariaDB releases with the vulnerable implementation; fixes are identified in the release lines listed in the advisory.
The issue occurs in MariaDB Server when ALTER TABLE ... CONVERT ... PARTITION processes user-specified partition names and constructs filesystem paths from them. Risk depends on the operation being available to an authenticated user and on the supplied name requiring filename escaping. The vulnerability affects MariaDB releases with the vulnerable implementation; fixes are identified in the release lines listed in the advisory.
Exploit preconditions
- Attack surface: MariaDB's
ALTER TABLE ... CONVERT ... PARTITIONoperation - Required access: An authenticated database account able to invoke the relevant operation
- Trigger point: Processing a user-specified partition name during partition conversion
- Why exploitation is possible: The name is used in filesystem path construction without the required filename encoding, potentially directing access to table files outside the user's authorization
- Attack surface: MariaDB's
ALTER TABLE ... CONVERT ... PARTITIONoperation - Required access: An authenticated database account able to invoke the relevant operation
- Trigger point: Processing a user-specified partition name during partition conversion
- Why exploitation is possible: The name is used in filesystem path construction without the required filename encoding, potentially directing access to table files outside the user's authorization
Why this happens
The server uses externally controlled partition names when constructing filesystem paths but does not apply the filename encoding needed to safely represent those names. This is an improper control of filenames or paths, mapped to CWE-73: External Control of File Name or Path. As a result, a database operation may resolve to files beyond the intended table files.
The server uses externally controlled partition names when constructing filesystem paths but does not apply the filename encoding needed to safely represent those names. This is an improper control of filenames or paths, mapped to CWE-73: External Control of File Name or Path. As a result, a database operation may resolve to files beyond the intended table files.
Potential impact
- An authenticated user may read table data they are not authorized to access.
- An authenticated user could modify or otherwise affect unauthorized table files.
- Data integrity or confidentiality across database tables may be compromised.
- An authenticated user may read table data they are not authorized to access.
- An authenticated user could modify or otherwise affect unauthorized table files.
- Data integrity or confidentiality across database tables may be compromised.
General mitigation guidance
Defensive approaches focus on ensuring that user-controlled identifiers cannot influence filesystem paths outside their intended scope.
- Apply consistent filename encoding or use safe internal identifiers when mapping partition names to files.
- Canonicalize and validate resolved paths, and ensure they remain within the intended table directory.
- Prefer APIs that operate on validated database objects rather than constructing paths from raw names.
- Restrict which accounts can invoke partition conversion operations, following least-privilege principles.
- Treat partition names and other database metadata as untrusted when crossing into filesystem operations.
Defensive approaches focus on ensuring that user-controlled identifiers cannot influence filesystem paths outside their intended scope.
- Apply consistent filename encoding or use safe internal identifiers when mapping partition names to files.
- Canonicalize and validate resolved paths, and ensure they remain within the intended table directory.
- Prefer APIs that operate on validated database objects rather than constructing paths from raw names.
- Restrict which accounts can invoke partition conversion operations, following least-privilege principles.
- Treat partition names and other database metadata as untrusted when crossing into filesystem operations.
How teams detect issues like this
- Review filesystem path construction that incorporates partition names or other user-controlled database identifiers.
- Use static analysis to flag path-building code that lacks encoding, canonicalization, or containment checks.
- Audit authorization rules for partition conversion operations and monitor their use by database accounts.
- Apply code-review and policy checks requiring safe path APIs and validation at filesystem boundaries.
- Review filesystem path construction that incorporates partition names or other user-controlled database identifiers.
- Use static analysis to flag path-building code that lacks encoding, canonicalization, or containment checks.
- Audit authorization rules for partition conversion operations and monitor their use by database accounts.
- Apply code-review and policy checks requiring safe path APIs and validation at filesystem boundaries.
