Summary
MariaDB's view FRM parser may incorrectly interpret embedded newline characters in specially crafted usernames as additional view metadata. An account with permission to create users and views with grant authority could abuse this behavior to influence security metadata and potentially gain elevated database privileges.
MariaDB's view FRM parser may incorrectly interpret embedded newline characters in specially crafted usernames as additional view metadata. An account with permission to create users and views with grant authority could abuse this behavior to influence security metadata and potentially gain elevated database privileges.
Affected context
The issue occurs in MariaDB deployments using affected server branches where view definitions are parsed from FRM data and usernames can contain embedded newline characters. Exploitation depends on an account having both the ability to create users and the ability to create views with the required grant authority. The parser's handling of username data must also allow the crafted content to be interpreted as view security metadata.
The issue occurs in MariaDB deployments using affected server branches where view definitions are parsed from FRM data and usernames can contain embedded newline characters. Exploitation depends on an account having both the ability to create users and the ability to create views with the required grant authority. The parser's handling of username data must also allow the crafted content to be interpreted as view security metadata.
Exploit preconditions
- Attack surface: MariaDB server view and account metadata handling
- Required access: An authenticated account with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges
- Trigger point: Processing a crafted username and subsequently parsing affected view metadata
- Why exploitation is possible: Embedded newline characters are not safely encoded, allowing username content to be confused with structured view security metadata
- Attack surface: MariaDB server view and account metadata handling
- Required access: An authenticated account with CREATE USER and CREATE VIEW WITH GRANT OPTION privileges
- Trigger point: Processing a crafted username and subsequently parsing affected view metadata
- Why exploitation is possible: Embedded newline characters are not safely encoded, allowing username content to be confused with structured view security metadata
Why this happens
The underlying bug is a failure to safely encode delimiter-sensitive data before embedding it in a serialized view representation. Because newline characters in a username can resemble metadata boundaries, the FRM parser may treat attacker-controlled identity data as trusted security attributes. This maps primarily to CWE-116: Improper Encoding or Escaping of Output, with characteristics related to CWE-144: Improper Neutralization of Line Delimiters, because line-oriented structural separators are not adequately neutralized.
The underlying bug is a failure to safely encode delimiter-sensitive data before embedding it in a serialized view representation. Because newline characters in a username can resemble metadata boundaries, the FRM parser may treat attacker-controlled identity data as trusted security attributes. This maps primarily to CWE-116: Improper Encoding or Escaping of Output, with characteristics related to CWE-144: Improper Neutralization of Line Delimiters, because line-oriented structural separators are not adequately neutralized.
Potential impact
- An attacker may escalate database privileges
- Unauthorized users could gain access to protected views or data
- View security metadata could be altered or misinterpreted
- Database confidentiality and integrity could be compromised
- An attacker may escalate database privileges
- Unauthorized users could gain access to protected views or data
- View security metadata could be altered or misinterpreted
- Database confidentiality and integrity could be compromised
General mitigation guidance
Mitigation generally focuses on preserving a strict separation between user-controlled identifiers and serialized metadata.
Common defensive patterns include:
- Encode or reject delimiter and control characters in usernames before serialization
- Use structured formats with unambiguous field boundaries rather than line-oriented metadata
- Parse metadata with strict schemas and reject unexpected fields or delimiters
- Apply least privilege so account-management and grant-bearing view privileges are narrowly assigned
- Treat identity fields as data only and prevent them from influencing parser state
- Monitor and restrict creation of unusual usernames and security-sensitive views
Mitigation generally focuses on preserving a strict separation between user-controlled identifiers and serialized metadata.
Common defensive patterns include:
- Encode or reject delimiter and control characters in usernames before serialization
- Use structured formats with unambiguous field boundaries rather than line-oriented metadata
- Parse metadata with strict schemas and reject unexpected fields or delimiters
- Apply least privilege so account-management and grant-bearing view privileges are narrowly assigned
- Treat identity fields as data only and prevent them from influencing parser state
- Monitor and restrict creation of unusual usernames and security-sensitive views
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying concatenation of user-controlled values into serialized metadata
- Code review checks for missing escaping of newline, delimiter, and control characters
- Tests using boundary characters in usernames and other identifiers
- Database policy controls that limit CREATE USER and CREATE VIEW WITH GRANT OPTION privileges
- Audit monitoring for unusual account names, unexpected view definers, or changes to view security attributes
- Automated security review tools that flag parser ambiguity and output-encoding weaknesses
Organizations can look for this class of issue through:
- Static analysis rules identifying concatenation of user-controlled values into serialized metadata
- Code review checks for missing escaping of newline, delimiter, and control characters
- Tests using boundary characters in usernames and other identifiers
- Database policy controls that limit CREATE USER and CREATE VIEW WITH GRANT OPTION privileges
- Audit monitoring for unusual account names, unexpected view definers, or changes to view security attributes
- Automated security review tools that flag parser ambiguity and output-encoding weaknesses
