CVE-2023-22094: Vulnerability in MySQL Installer Allows Low Privileged Attackers to Compromise Data and Cause Denial of Service (DoS)

A critical vulnerability has been discovered in the MySQL Installer product of Oracle MySQL, affecting versions prior to 1.6.8. The vulnerability, identified as CVE-2023-22094, can be easily exploited by low privileged attackers who have access to the infrastructure where MySQL Installer is executed. Successful attacks require human intervention and may impact additional products, leading to unauthorized creation, deletion, or modification of critical data in MySQL Installer. Moreover, attackers can cause a hang or frequently repeatable crash of MySQL Installer, resulting in a complete Denial of Service (DoS). Note that this patch has been applied to MySQL Server bundled versions 8..35 and 5.7.44.

CVSS 3.1 Base Score: 7.9 (Integrity and Availability impacts)
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H)

Original References

1. Oracle Critical Patch Update Advisory - January 2023
2. MySQL Release Notes
3. NVD - CVE-2023-22094

Code Snippet

The vulnerable MySQL Installer component (Installer: General) prior to version 1.6.8 can be exploited by an attacker with low-level access to the infrastructure. When the attacker successfully triggers the vulnerability, they can compromise critical data or cause a complete DoS in MySQL Installer. An example of the vulnerability in action is shown below:

# Exploit: CVE-2023-22094 Proof of Concept
# Author: [Attacker]
# Tested on: MySQL Installer (versions prior to 1.6.8)

import os

MYSQL_INSTALLER_PATH = "/path/to/mysql/installer"  # Change this to the actual path of MySQL Installer on your system
EXPLOIT_CODE = "<<insert exploit code here>>"  # Exploit code with syntax specific to the vulnerability

os.chdir(MYSQL_INSTALLER_PATH)
os.system(EXPLOIT_CODE)

Exploit Details

The vulnerability (CVE-2023-22094) allows a low privileged attacker to compromise MySQL Installer by exploiting the Installer: General component. If the attacker is successful, they gain unauthorized access to critical data, including the ability to create, delete, or modify all MySQL Installer accessible data. Additionally, the attacker can repeatedly crash MySQL Installer, resulting in a complete DoS situation.

Mitigation and Patch

Oracle has released a patch for this vulnerability in MySQL Installer version 1.6.8. Users of MySQL Installer are advised to update their software to the latest version to mitigate the risk of exploitation. Note that this patch is already in place for the MySQL Server bundled versions 8..35 and 5.7.44. Updating to the latest version ensures the integrity and availability of your MySQL Installer data and prevents unauthorized attacks that may lead to a complete system compromise or DoS.

Conclusion

CVE-2023-22094 is a critical vulnerability affecting the MySQL Installer product of Oracle MySQL (versions prior to 1.6.8). Low privileged attackers can exploit the vulnerability to compromise critical data within MySQL Installer and cause complete DoS conditions. Mitigating the risk is crucial to preventing unauthorized access and ensuring the overall security of your infrastructure. Update to MySQL Installer version 1.6.8 or above and apply the appropriate patches as required. Always stay vigilant by keeping your systems updated and following secure coding practices to protect against future vulnerabilities.

Timeline

Published on: 10/17/2023 22:15:14 UTC
Last modified on: 10/24/2023 23:46:20 UTC