Listen to this Post
When PAM (dialog) authentication is used, the MariaDB Connector/J can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user’s password.
The `mysql_clear_password` plugin is gated behind a secure connection: the driver refuses to transmit the password in cleartext over plain TCP. The sibling PAM plugin handler (SendPamAuthPacketFactory, server-side plugin name dialog) did not override that gate and inherited the default value false, so it was not subject to the same secure-transport requirement. As a result, a hostile or man-in-the-middle server can issue an Authentication Switch Request for the `dialog` plugin over plain TCP, and the driver responds with the user’s password in cleartext. With the default configuration (sslMode=DISABLE, restrictedAuth=null) this is reachable with no non-default options.
You are affected if all of the following hold: (1) You use MariaDB Connector/J at a version below the patched release(s); (2) Connections can occur over an insecure transport — i.e. plain TCP (sslMode=DISABLE), or a TLS mode that establishes server identity only via self-signed-certificate fingerprint validation; (3) An attacker can occupy an on-path (MITM) position, or otherwise cause the client to connect to a server they control, and present an Authentication Switch Request for the `dialog` plugin. Connections over properly verified TLS or a local Unix socket are not exposed to this vector.
DailyCVE Form:
Platform: MariaDB Connector/J
Version: <2.7.14, <3.3.5, <3.4.3, <3.5.9
Vulnerability: Cleartext password disclosure
Severity: Medium (CVSS 5.9)
Date: 2026-08-29
Prediction: Patch already available (2026-06-15)
What Undercode Say:
Check your MariaDB Connector/J version For Maven projects: mvn dependency:tree | grep mariadb-java-client For Gradle projects: gradle dependencies | grep mariadb-java-client Check current sslMode configuration Look for sslMode=DISABLE in connection string or configuration grep -r "sslMode" ./src/ --include=".java" --include=".properties" --include=".xml"
Vulnerable Code Pattern (Educational Purposes!):
// VULNERABLE: Default configuration with sslMode=DISABLE String url = "jdbc:mariadb://database.example.com:3306/mydb"; Connection conn = DriverManager.getConnection(url, "user", "password"); // Attacker on the network can send AuthSwitchRequest for 'dialog' // and receive the password in cleartext
Exploit: (Educational Purposes!)
MITM position: Attacker intercepts connection and sends Authentication Switch Request packet for 'dialog' plugin The driver responds with password in cleartext over TCP Tools like Wireshark can capture the plaintext password Example packet capture filter to observe the vulnerability: tcpdump -i eth0 -A -s 0 'port 3306' | grep -i "password"
Protection:
- Upgrade immediately to patched versions: 2.7.14, 3.3.5, 3.4.3, or 3.5.9
- Connect over verified TLS (
sslMode=verify-fullorsslMode=REQUIRED) - Use a local Unix socket instead of TCP
- Restrict permitted authentication plugins via `restrictedAuth` to prevent `dialog` negotiation over insecure transports
Impact:
Disclosure of the authenticating account’s password in cleartext to an on-path or hostile server. The captured credentials can then be reused to authenticate to the database. This vulnerability aligns with CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
