● Zion Boggan
repos/security-portfolio/security-research-notebook/mysql-credential-exposure/index.html
zionboggan.com ↗
Code Commits Tags
331 lines · html
History for this file →
1
<!doctype html>
2
<html lang="en"><head><meta charset="utf-8">
3
<meta name="viewport" content="width=device-width, initial-scale=1.0">
4
<title>Aiven Internal System Account Password Hashes Exposed to Customer Users via mysql.user SELECT on Aiven Managed MySQL | Zion Boggan</title>
5
<meta name="description" content="MySQL binlog ACL bypass surfaces replication credentials.">
6
<link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Crect width='32' height='32' rx='6' fill='%230c0e12'/%3E%3Ctext x='16' y='22' font-family='monospace' font-size='15' fill='%236cc7b8' text-anchor='middle'%3Ezb%3C/text%3E%3C/svg%3E">
7
<style>
8
  :root{
9
    --bg:#0c0e12; --bg2:#0f1217; --panel:#14181f; --panel2:#171c24;
10
    --line:#222936; --line2:#2c3543;
11
    --ink:#e8eaed; --soft:#c3cad4; --muted:#8a94a3; --faint:#5d6675;
12
    --accent:#6cc7b8; --accent-dim:#274b47;
13
    --maxw:1020px;
14
  }
15
  *{box-sizing:border-box;}
16
  html{scroll-behavior:smooth;}
17
  body{margin:0;background:var(--bg);color:var(--ink);
18
    font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
19
    font-size:16px;line-height:1.65;-webkit-font-smoothing:antialiased;}
20
  .mono{font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,monospace;}
21
  a{color:var(--accent);text-decoration:none;}
22
  a:hover{color:#8fe0d2;}
23
  .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px;}
24
25
  /* nav */
26
  nav{position:sticky;top:0;z-index:20;background:rgba(12,14,18,.82);
27
    backdrop-filter:blur(10px);border-bottom:1px solid var(--line);}
28
  nav .wrap{display:flex;align-items:center;justify-content:space-between;height:58px;}
29
  nav .brand{font-weight:600;letter-spacing:.2px;}
30
  nav .brand .dot{color:var(--accent);}
31
  nav .links{display:flex;gap:26px;font-size:13.5px;}
32
  nav .links a{color:var(--muted);}
33
  nav .links a:hover{color:var(--ink);}
34
  @media(max-width:680px){nav .links{display:none;}}
35
36
  /* hero */
37
  header.hero{padding:74px 0 54px;border-bottom:1px solid var(--line);
38
    background:radial-gradient(900px 380px at 78% -10%, #11201e 0%, transparent 60%);}
39
  .avail{font-size:12.5px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);
40
    display:flex;align-items:center;gap:9px;margin-bottom:20px;}
41
  .avail .pulse{width:7px;height:7px;border-radius:50%;background:var(--accent);
42
    box-shadow:0 0 0 0 rgba(108,199,184,.5);animation:p 2.4s infinite;}
43
  @keyframes p{0%{box-shadow:0 0 0 0 rgba(108,199,184,.45)}70%{box-shadow:0 0 0 8px rgba(108,199,184,0)}100%{box-shadow:0 0 0 0 rgba(108,199,184,0)}}
44
  h1{font-size:clamp(34px,6vw,52px);line-height:1.05;margin:0 0 8px;letter-spacing:-1px;font-weight:680;}
45
  .hero .sub{font-size:clamp(16px,2.4vw,20px);color:var(--soft);margin:0 0 24px;font-weight:500;}
46
  .hero .lede{max-width:660px;color:var(--soft);font-size:17px;margin:0 0 28px;}
47
  .hero .lede b{color:var(--ink);font-weight:600;}
48
  .cta{display:flex;flex-wrap:wrap;gap:12px;align-items:center;}
49
  .btn{display:inline-flex;align-items:center;gap:8px;padding:10px 18px;border-radius:8px;
50
    font-size:14.5px;font-weight:550;border:1px solid var(--line2);color:var(--ink);background:var(--panel);}
51
  .btn:hover{border-color:var(--accent-dim);background:var(--panel2);color:var(--ink);}
52
  .btn.primary{background:var(--accent);color:#06231f;border-color:var(--accent);font-weight:650;}
53
  .btn.primary:hover{background:#8fe0d2;color:#06231f;}
54
  .meta{margin-top:26px;display:flex;flex-wrap:wrap;gap:8px 22px;font-size:13px;color:var(--muted);}
55
  .meta .mono{color:var(--faint);}
56
57
  /* sections */
58
  section{padding:64px 0;border-bottom:1px solid var(--line);}
59
  .shead{display:flex;align-items:baseline;gap:14px;margin-bottom:30px;}
60
  .shead .idx{font-size:13px;color:var(--accent);letter-spacing:1px;}
61
  .shead h2{font-size:14px;letter-spacing:2px;text-transform:uppercase;color:var(--muted);margin:0;font-weight:600;}
62
  .shead .rule{flex:1;height:1px;background:var(--line);}
63
64
  /* flagship */
65
  .flag{background:linear-gradient(180deg,var(--panel) 0%,var(--bg2) 100%);
66
    border:1px solid var(--line2);border-radius:14px;overflow:hidden;}
67
  .flag .top{padding:30px 32px 8px;}
68
  .flag .tag{font-size:12px;letter-spacing:1.5px;text-transform:uppercase;color:var(--accent);margin-bottom:12px;}
69
  .flag h3{font-size:27px;margin:0 0 6px;letter-spacing:-.4px;}
70
  .flag h3 .v{font-size:13px;color:var(--muted);font-weight:500;margin-left:8px;letter-spacing:0;}
71
  .flag .grid{display:grid;grid-template-columns:1.25fr 1fr;gap:30px;padding:14px 32px 30px;}
72
  .flag p{color:var(--soft);margin:0 0 16px;}
73
  .flag .stats{display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-top:6px;}
74
  .stat{background:var(--bg);border:1px solid var(--line);border-radius:9px;padding:13px 15px;}
75
  .stat .n{font-size:21px;font-weight:680;color:var(--ink);}
76
  .stat .k{font-size:12px;color:var(--muted);margin-top:2px;}
77
  .spec{background:var(--bg);border:1px solid var(--line);border-radius:10px;padding:18px 18px;}
78
  .spec .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:10px;}
79
  .spec ul{margin:0;padding:0;list-style:none;font-size:13.5px;}
80
  .spec li{padding:6px 0;border-top:1px solid var(--line);color:var(--soft);display:flex;justify-content:space-between;gap:14px;}
81
  .spec li:first-child{border-top:none;}
82
  .spec li span{color:var(--muted);}
83
  .flag .foot{padding:0 32px 28px;display:flex;gap:18px;flex-wrap:wrap;font-size:14px;}
84
  @media(max-width:720px){.flag .grid{grid-template-columns:1fr;}}
85
86
  /* lab cards */
87
  .cards{display:grid;grid-template-columns:1fr 1fr;gap:20px;}
88
  @media(max-width:680px){.cards{grid-template-columns:1fr;}}
89
  .card{border:1px solid var(--line);border-radius:12px;overflow:hidden;background:var(--panel);
90
    display:flex;flex-direction:column;transition:border-color .15s,transform .15s;}
91
  .card:hover{border-color:var(--accent-dim);transform:translateY(-2px);}
92
  .card .thumb{height:172px;overflow:hidden;border-bottom:1px solid var(--line);background:#fff;}
93
  .card .thumb img{width:100%;height:100%;object-fit:cover;object-position:top left;display:block;}
94
  .card .body{padding:18px 20px 20px;display:flex;flex-direction:column;flex:1;}
95
  .card h3{margin:0 0 9px;font-size:17px;}
96
  .card p{margin:0 0 14px;font-size:14px;color:var(--soft);flex:1;}
97
  .tags{display:flex;flex-wrap:wrap;gap:6px;margin-bottom:14px;}
98
  .tags span{font-size:11.5px;color:var(--muted);background:var(--bg);border:1px solid var(--line);
99
    border-radius:5px;padding:3px 8px;}
100
  .card .lnk{font-size:13.5px;font-family:ui-monospace,Menlo,monospace;}
101
  .card .lnk::after{content:" →";}
102
103
  /* research */
104
  .rlede{color:var(--soft);max-width:680px;margin:-6px 0 26px;}
105
  .research{display:flex;flex-direction:column;gap:0;border:1px solid var(--line);border-radius:12px;overflow:hidden;}
106
  .ritem{display:grid;grid-template-columns:120px 1fr auto;gap:18px;align-items:center;
107
    padding:18px 22px;border-top:1px solid var(--line);}
108
  .ritem:first-child{border-top:none;}
109
  .ritem:hover{background:var(--panel);}
110
  .ritem .cls{font-size:11px;letter-spacing:.5px;text-transform:uppercase;color:var(--accent);}
111
  .ritem h3{margin:0 0 3px;font-size:16px;}
112
  .ritem p{margin:0;font-size:13.5px;color:var(--muted);}
113
  .ritem .go{font-family:ui-monospace,Menlo,monospace;font-size:13px;white-space:nowrap;}
114
  @media(max-width:680px){.ritem{grid-template-columns:1fr;gap:6px;}.ritem .go{margin-top:4px;}}
115
  .progs{margin-top:22px;}
116
  .progs .sk{font-size:11px;letter-spacing:1.5px;text-transform:uppercase;color:var(--faint);margin-bottom:11px;}
117
  .progs .row{display:flex;flex-wrap:wrap;gap:7px;}
118
  .progs .row span{font-size:12.5px;color:var(--soft);background:var(--panel);border:1px solid var(--line);
119
    border-radius:6px;padding:4px 10px;}
120
121
  /* credentials */
122
  .cred{display:grid;grid-template-columns:1.1fr 1fr;gap:28px;}
123
  @media(max-width:680px){.cred{grid-template-columns:1fr;}}
124
  .cred p{color:var(--soft);margin:0 0 14px;}
125
  .cred .role{font-size:14px;color:var(--muted);}
126
  .cred .role b{color:var(--ink);font-weight:600;}
127
  .certs{list-style:none;margin:0;padding:0;}
128
  .certs li{padding:9px 0;border-top:1px solid var(--line);font-size:14px;color:var(--soft);
129
    display:flex;gap:10px;align-items:baseline;}
130
  .certs li:first-child{border-top:none;}
131
  .certs li .c{color:var(--accent);font-family:ui-monospace,Menlo,monospace;font-size:12px;}
132
133
  footer{padding:46px 0 64px;}
134
  footer .row{display:flex;flex-wrap:wrap;justify-content:space-between;gap:18px;align-items:center;}
135
  footer .links a{color:var(--soft);margin-right:20px;font-size:14px;}
136
  footer .note{color:var(--faint);font-size:12.5px;max-width:520px;}
137
138
  .detail-hero{padding:40px 0 26px;}
139
  .back{display:inline-block;font-size:13px;color:var(--muted);margin-bottom:20px;font-family:ui-monospace,Menlo,monospace;}
140
  .back:hover{color:var(--ink);}
141
  .kicker{font-size:12px;letter-spacing:2px;text-transform:uppercase;color:var(--accent);margin-bottom:13px;font-family:ui-monospace,Menlo,monospace;}
142
  .detail-hero h1{font-size:clamp(26px,4.6vw,38px);margin:0 0 12px;letter-spacing:-.5px;}
143
  .detail-hero .tagline{font-size:clamp(15px,2vw,18px);color:var(--soft);max-width:800px;margin:0 0 16px;}
144
  .facts{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:12px;margin-top:22px;}
145
  .content{padding:8px 0 0;max-width:840px;}
146
  .content h1{font-size:24px;margin:40px 0 14px;letter-spacing:-.4px;color:var(--ink);}
147
  .content h2{font-size:13px;letter-spacing:2px;text-transform:uppercase;color:var(--muted);margin:42px 0 15px;font-weight:600;border-top:1px solid var(--line);padding-top:28px;}
148
  .content h3{font-size:17px;margin:28px 0 10px;color:var(--ink);font-weight:600;}
149
  .content h4{font-size:14px;margin:22px 0 8px;color:var(--soft);font-weight:600;text-transform:uppercase;letter-spacing:.5px;}
150
  .content p{color:var(--soft);margin:0 0 15px;}
151
  .content ul,.content ol{color:var(--soft);margin:0 0 15px;padding-left:22px;}
152
  .content li{margin:5px 0;}
153
  .content strong{color:var(--ink);font-weight:600;}
154
  .content a{color:var(--accent);}
155
  .content code{font-family:ui-monospace,Menlo,monospace;font-size:12.8px;background:var(--panel2);border:1px solid var(--line);border-radius:4px;padding:1px 5px;color:var(--soft);}
156
  .content pre{background:var(--bg2);border:1px solid var(--line2);border-radius:10px;padding:15px 18px;overflow-x:auto;margin:0 0 18px;}
157
  .content pre code{background:none;border:none;padding:0;font-size:12.4px;color:var(--soft);line-height:1.6;white-space:pre;}
158
  .content table{width:100%;border-collapse:collapse;margin:2px 0 20px;font-size:13.3px;}
159
  .content th{text-align:left;color:var(--muted);font-weight:600;border-bottom:1px solid var(--line2);padding:9px 12px;font-size:11px;letter-spacing:.6px;text-transform:uppercase;}
160
  .content td{color:var(--soft);border-bottom:1px solid var(--line);padding:9px 12px;vertical-align:top;}
161
  .content blockquote{border-left:3px solid var(--accent-dim);margin:0 0 16px;padding:2px 0 2px 18px;color:var(--muted);}
162
  .content hr{border:none;border-top:1px solid var(--line);margin:30px 0;}
163
  /* notebook index */
164
  .nbgroup{margin:40px 0 0;}
165
  .nbgroup h2{font-size:13px;letter-spacing:2px;text-transform:uppercase;color:var(--accent);margin:0 0 4px;font-weight:600;}
166
  .nbgroup .gd{color:var(--faint);font-size:13px;margin:0 0 14px;}
167
  .nbtable{width:100%;border-collapse:collapse;font-size:14px;border:1px solid var(--line);border-radius:12px;overflow:hidden;}
168
  .nbtable tr{border-top:1px solid var(--line);}
169
  .nbtable tr:first-child{border-top:none;}
170
  .nbtable tr:hover{background:var(--panel);}
171
  .nbtable td{padding:14px 16px;vertical-align:top;}
172
  .nbtable .cls{white-space:nowrap;color:var(--accent);font-family:ui-monospace,Menlo,monospace;font-size:11.5px;text-transform:uppercase;letter-spacing:.5px;width:150px;}
173
  .nbtable .ti a{font-weight:600;color:var(--ink);}
174
  .nbtable .ti a:hover{color:var(--accent);}
175
  .nbtable .ol{color:var(--muted);font-size:13px;margin-top:3px;}
176
  @media(max-width:680px){.nbtable .cls{width:auto;display:block;}}
177
</style>
178
<link rel="canonical" href="https://zionboggan.com/security-research-notebook/mysql-credential-exposure/">
179
<meta name="author" content="Zion Boggan">
180
<meta name="robots" content="index, follow, max-image-preview:large">
181
<meta property="og:type" content="article">
182
<meta property="og:site_name" content="Zion Boggan">
183
<meta property="og:title" content="Aiven Internal System Account Password Hashes Exposed to Customer Users via mysql.user SELECT on Aiven Managed MySQL | Zion Boggan">
184
<meta property="og:description" content="MySQL binlog ACL bypass surfaces replication credentials.">
185
<meta property="og:url" content="https://zionboggan.com/security-research-notebook/mysql-credential-exposure/">
186
<meta property="og:image" content="https://zionboggan.com/assets/og-default.png">
187
<meta name="twitter:card" content="summary_large_image">
188
<meta name="twitter:title" content="Aiven Internal System Account Password Hashes Exposed to Customer Users via mysql.user SELECT on Aiven Managed MySQL | Zion Boggan">
189
<meta name="twitter:description" content="MySQL binlog ACL bypass surfaces replication credentials.">
190
<meta name="twitter:image" content="https://zionboggan.com/assets/og-default.png">
191
<script type="application/ld+json">{"@context":"https://schema.org","@type":"TechArticle","headline":"Aiven Internal System Account Password Hashes Exposed to Customer Users via mysql.user SELECT on Aiven Managed MySQL","description":"MySQL binlog ACL bypass surfaces replication credentials.","url":"https://zionboggan.com/security-research-notebook/mysql-credential-exposure/","image":"https://zionboggan.com/assets/og-default.png","author":{"@type":"Person","name":"Zion Boggan","url":"https://zionboggan.com"},"publisher":{"@type":"Person","name":"Zion Boggan"}}</script>
192
</head><body>
193
<nav><div class="wrap">
194
  <a class="brand mono" href="/" style="color:var(--ink)">zion_boggan<span class="dot">.</span></a>
195
  <span class="links"><a href="/#oversight">Oversight</a><a href="/#labs">Labs</a><a href="/#research">Research</a><a href="/security-research-notebook/">Notebook</a><a href="/">Home</a></span>
196
</div></nav>
197
<header class="hero detail-hero"><div class="wrap">
198
  <a class="back" href="/security-research-notebook/">&larr; Research notebook</a>
199
  <div class="kicker">Info disclosure</div>
200
  <h1>Aiven Internal System Account Password Hashes Exposed to Customer Users via mysql.user SELECT on Aiven Managed MySQL</h1>
201
</div></header>
202
<section><div class="wrap"><div class="content">
203
<h2>Summary</h2>
204
<p>On Aiven&rsquo;s managed MySQL service, the default <code>avnadmin</code> user has unrestricted <code>SELECT</code> access to the <code>mysql.user</code> system table, which exposes the <code>caching_sha2_password</code> password hashes for ALL system accounts, including Aiven&rsquo;s internal <code>root</code> user, the <code>repluser</code> replication account, and the <code>metrics_user_datadog</code> and <code>metrics_user_telegraf</code> monitoring accounts.</p>
205
<p>The root account (<code>root@fda7:a938:5bfe:5fa6:%</code>) has full <code>SUPER</code>, <code>FILE</code>, <code>SHUTDOWN</code>, and all administrative privileges, and is accessible from any host within Aiven&rsquo;s internal IPv6 ULA prefix. Any customer who can crack the root password hash and access the internal network (e.g., via a cross-service SSRF from another compromised Aiven service) gains full MySQL root access with capabilities far exceeding what <code>avnadmin</code> is intended to have, including <code>FILE</code> (arbitrary file read/write), <code>SUPER</code> (bypass all restrictions), and <code>SHUTDOWN</code>.</p>
206
<p>Aiven demonstrates clear intent to restrict <code>avnadmin</code>&lsquo;s access to the mysql system schema by explicitly revoking INSERT, UPDATE, DELETE, CREATE, DROP, and other write privileges on <code>mysql.*</code>. However, <code>SELECT</code> was not revoked, exposing all credential data.</p>
207
<h2>Affected Target</h2>
208
<ul>
209
<li><strong>Service:</strong> Aiven for MySQL (Tier 2)</li>
210
<li><strong>Version tested:</strong> MySQL 8.0.45</li>
211
<li><strong>Instance:</strong> <host>:12741</li>
212
</ul>
213
<h2>Severity</h2>
214
<p><strong>P2, Sensitive Data Exposure</strong></p>
215
<p><strong>VRT:</strong> Server Security Misconfiguration &gt; Database Management System (DBMS) Misconfiguration &gt; Excessively Privileged User / DBA</p>
216
<p><strong>CVSS 3.1:</strong> <code>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N</code>, <strong>Score: 7.7 (High)</strong></p>
217
<ul>
218
<li><strong>C:H</strong>, Complete credential exposure of all system accounts including root</li>
219
<li><strong>S:C</strong>, Scope changed: customer credentials expose Aiven&rsquo;s internal infrastructure accounts</li>
220
</ul>
221
<h2>Steps to Reproduce</h2>
222
<h3>One-command credential dump</h3>
223
<pre><code class="language-sql">SELECT user, host, plugin, authentication_string, Super_priv,
224
       Grant_priv, password_expired, account_locked
225
FROM mysql.user;
226
</code></pre>
227
<h3>Actual output on Aiven (redacted hashes truncated):</h3>
228
<pre><code>+----------------------------+-------------------------------+---------------------------+--------------------------------------------------+
229
| user                       | host                          | plugin                    | authentication_string (truncated)                |
230
+----------------------------+-------------------------------+---------------------------+--------------------------------------------------+
231
| avnadmin                   | %                             | caching_sha2_password     | $A$005$&lt;hash&gt;                                    |
232
| repluser                   | %                             | caching_sha2_password     | $A$005$&lt;hash&gt;                                    |
233
| metrics_user_datadog       | ::1                           | caching_sha2_password     | $A$005$&lt;hash&gt;                                    |
234
| metrics_user_telegraf      | ::1                           | caching_sha2_password     | $A$005$&lt;hash&gt;                                    |
235
| root                       | fda7:a938:5bfe:5fa6:%         | caching_sha2_password     | $A$005$&lt;hash&gt;  (Super=Y, Grant=Y, locked=N)      |
236
| mysql.infoschema           | localhost                     | caching_sha2_password     | THISISACOMBINATIONOFINVALID...                   |
237
| mysql.session              | localhost                     | caching_sha2_password     | THISISACOMBINATIONOFINVALID...                   |
238
| mysql.sys                  | localhost                     | caching_sha2_password     | THISISACOMBINATIONOFINVALID...                   |
239
+----------------------------+-------------------------------+---------------------------+--------------------------------------------------+
240
</code></pre>
241
<h3>Key exposed accounts:</h3>
242
<table>
243
<thead>
244
<tr>
245
<th>Account</th>
246
<th>Host Restriction</th>
247
<th>Privileges</th>
248
<th>Risk</th>
249
</tr>
250
</thead>
251
<tbody>
252
<tr>
253
<td><code>root</code></td>
254
<td><code>fda7:a938:5bfe:5fa6:%</code></td>
255
<td>ALL + SUPER + FILE + SHUTDOWN</td>
256
<td>Full server control from internal network</td>
257
</tr>
258
<tr>
259
<td><code>repluser</code></td>
260
<td><code>%</code> (any host)</td>
261
<td>REPLICATION SLAVE + SERVICE_CONNECTION_ADMIN</td>
262
<td>Binary log streaming from anywhere</td>
263
</tr>
264
<tr>
265
<td><code>metrics_user_datadog</code></td>
266
<td><code>::1</code> (localhost)</td>
267
<td>Monitoring access</td>
268
<td>Internal monitoring disruption</td>
269
</tr>
270
<tr>
271
<td><code>metrics_user_telegraf</code></td>
272
<td><code>::1</code> (localhost)</td>
273
<td>Monitoring access</td>
274
<td>Internal monitoring disruption</td>
275
</tr>
276
</tbody>
277
</table>
278
<h2>Impact</h2>
279
<h3>1. Internal Root Account Credential Exposure</h3>
280
<p>The <code>root@fda7:a938:5bfe:5fa6:%</code> user has ALL privileges including SUPER, FILE, and SHUTDOWN. Its password hash is fully exposed. The host restriction uses Aiven&rsquo;s internal IPv6 ULA prefix (<code>fda7:a938:5bfe:5fa6::/80</code>), which is shared across Aiven services in the same region.</p>
281
<p>An attacker who cracks the root hash can escalate to full MySQL root from any other Aiven service on the internal network, gaining capabilities that <code>avnadmin</code> intentionally lacks:
282
- <strong>FILE privilege</strong>: Read/write arbitrary files on the MySQL host
283
- <strong>SUPER privilege</strong>: Bypass all access restrictions, change global variables, kill any process
284
- <strong>SHUTDOWN privilege</strong>: Stop the MySQL server
285
- <strong>SYSTEM_VARIABLES_ADMIN</strong>: Enable <code>local_infile</code>, change <code>secure_file_priv</code>, modify logging</p>
286
<h3>2. Replication Account Exposure</h3>
287
<p>The <code>repluser@%</code> account has REPLICATION SLAVE privilege with no host restriction. If its password is cracked, an attacker can connect from any IP and stream the entire binary log, exfiltrating ALL data changes including INSERTs with sensitive values (passwords, tokens, PII).</p>
288
<h3>3. Cross-Service Escalation Path</h3>
289
<p>The internal IPv6 prefix <code>fda7:a938:5bfe:5fa6::/80</code> is the same prefix discovered via PostgreSQL SSRF (documented in separate submission). This creates a cross-service attack chain:</p>
290
<pre><code>Customer MySQL (avnadmin) → SELECT mysql.user → root password hash
291
                          → Crack hash offline
292
Customer PG (SSRF via dblink) → Connect to MySQL internal IPv6
293
                              → Authenticate as root with cracked password
294
                              → Full MySQL root: FILE, SUPER, SHUTDOWN
295
</code></pre>
296
<h3>4. Additional Information Disclosure</h3>
297
<p>The <code>admin_address</code> global variable reveals the MySQL admin interface binding: <code>fda7:a938:5bfe:5fa6:0:5a9:6ce7:66e1</code>. Combined with the root hash, this pinpoints the exact target for internal privilege escalation.</p>
298
<p>Binary logs are also readable via <code>SHOW BINLOG EVENTS</code>, exposing all DDL/DML history including CREATE USER statements with IDENTIFIED BY clauses.</p>
299
<h2>Root Cause</h2>
300
<p>Aiven&rsquo;s privilege model for <code>avnadmin</code> explicitly revokes write operations on the <code>mysql</code> schema:</p>
301
<pre><code class="language-sql">REVOKE INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER,
302
       CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, SHOW VIEW,
303
       CREATE ROUTINE, ALTER ROUTINE, EVENT, TRIGGER
304
ON &quot;mysql&quot;.* FROM &quot;avnadmin&quot;@&quot;%&quot;
305
</code></pre>
306
<p>This demonstrates Aiven&rsquo;s intent to restrict access to system tables. However, <code>SELECT</code> was not included in the revocation, allowing full read access to <code>mysql.user</code> and all system tables containing credentials and configuration.</p>
307
<h2>Recommended Fix</h2>
308
<ol>
309
<li>
310
<p><strong>Immediate:</strong> Revoke SELECT on <code>mysql.user</code> for <code>avnadmin</code>:
311
   <code>sql
312
   REVOKE SELECT ON mysql.user FROM 'avnadmin'@'%';</code>
313
   Or more broadly:
314
   <code>sql
315
   REVOKE SELECT ON mysql.* FROM 'avnadmin'@'%';
316
   GRANT SELECT ON mysql.func TO 'avnadmin'@'%';  -- if needed for UDF listing</code></p>
317
</li>
318
<li>
319
<p><strong>Defense in depth:</strong> Restrict the <code>root</code> user&rsquo;s host to a narrower range than the entire <code>/80</code> prefix, or disable the root account entirely and manage via a separate orchestration channel.</p>
320
</li>
321
<li>
322
<p><strong>Rotate credentials:</strong> The exposed hashes for root, repluser, and monitoring accounts should be rotated, as they may have already been read by other researchers or attackers.</p>
323
</li>
324
</ol>
325
<hr><p style="color:var(--faint);font-size:12.5px;font-family:ui-monospace,Menlo,monospace">Source &middot; github.com/zionboggan/security-research-notebook &middot; writeups/aiven/mysql-credential-exposure.md</p>
326
</div></div></section>
327
<footer><div class="wrap row">
328
  <div class="links"><a href="/">Portfolio</a><a href="https://www.linkedin.com/in/zion-boggan">LinkedIn</a><a href="/security-research-notebook/">Notebook</a><a href="mailto:zionboggan0@gmail.com">Email</a></div>
329
  <div class="note">Coordinated-disclosure research. Findings appear here only after the program's disclosure window closed, the patch shipped, or a CVE was published. No customer data was accessed.</div>
330
</div></footer>
331
</body></html>