Listen to this Post
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to version 1.4.1, the connector does not gate clear-text password authentication plugins on transport encryption. The root cause is that the `AuthenticationPlugin` interface has no capability for a plugin to require a secure connection. Because no such gate exists, clear-text plugins run regardless of whether the connection is encrypted.
A hostile or man-in-the-middle MariaDB server can send an `AuthSwitchRequest` naming `mysql_clear_password` or `dialog` (PAM) over a plain-TCP unencrypted connection. The `AuthenticationFlow` permits `ClearPasswordPluginFlow` or `PamPluginFlow` to return the user’s password as cleartext bytes on the wire. The driver does not require a secure transport before using clear-text-password authentication plugins. A hostile or man-in-the-middle server can issue an `AuthSwitchRequest` naming `mysql_clear_password` or `dialog` (PAM) over a plain-TCP, unencrypted connection, and the driver replies with the user’s password as cleartext bytes on the wire.
The account password is transmitted in cleartext to the peer. An on-path attacker (MITM) who presents themselves as the server can capture the password during the authentication handshake. The disclosed credentials can subsequently be used to authenticate directly against the database server. The flaw is classified as CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials). The vulnerability carries a CVSS score of 5.9, indicating moderate severity. The issue is fixed in version 1.4.1. Clear-text authentication plugins (mysql_clear_password, dialog/PAM) now require a secure connection: the `AuthenticationPlugin` contract can declare that a plugin requires a secure transport, and such plugins are permitted only over an encrypted connection.
DailyCVE Form:
Platform: MariaDB Connector/R2DBC
Version: < 1.4.1
Vulnerability: Cleartext password disclosure
Severity: Medium (CVSS 5.9)
Date: 2026-08-28
Prediction: Patch already available (1.4.1)
What Undercode Say:
Analytics
Check your connector version:
For Maven projects, check pom.xml grep -A 5 "r2dbc-mariadb" pom.xml For Gradle projects grep "r2dbc-mariadb" build.gradle Check installed version via dependency tree mvn dependency:tree | grep r2dbc-mariadb
Verify SSL/TLS configuration:
Check if SSL is properly configured in connection string Vulnerable: jdbc:mariadb://host:port/database?sslMode=DISABLE Secure: jdbc:mariadb://host:port/database?sslMode=VERIFY_CA&serverSslCert=ca.pem Audit connection settings in application.properties grep -i "ssl" application.properties grep -i "mariadb" application.properties
Monitor for suspicious AuthSwitchRequest activity:
Capture MySQL protocol handshake traffic tcpdump -i any -s 0 -w mariadb_handshake.pcap port 3306 Look for AuthSwitchRequest packets in Wireshark with filter: mysql.auth_switch_request
Exploit: (Educational Purposes!)
1. Setup a rogue MariaDB server (MITM position) 2. When client connects, send AuthSwitchRequest for mysql_clear_password 3. Capture the cleartext password from the wire Example using Python with scapy to spoof server response Note: This is for educational purposes only from scapy.all import import socket Setup listener on port 3306 When client initiates handshake, respond with: AuthSwitchRequest packet: - auth_plugin_name: "mysql_clear_password" - auth_plugin_data: (empty or arbitrary) Client will then send password in cleartext Monitor captured traffic: tshark -i eth0 -Y "mysql.auth_plugin_name == \"mysql_clear_password\"" -T fields -e data
Protection
- Upgrade to MariaDB Connector/R2DBC version 1.4.1 or later
- Configure certificate verification explicitly: provide the server/CA certificate and use a verifying SSL mode (e.g., `VERIFY_CA` /
VERIFY_FULL) so the connection is encrypted and the server’s identity is established before credentials are sent - Restrict the connector’s use to networks where TLS or other transport security is enforced
- Configure the client to reject AuthSwitchRequest messages that request clear-text plugins and ensure that only secure transports are used for database connections
Impact
The account password is transmitted in cleartext to the peer. An on-path attacker (MITM) who presents themselves as the server can capture the password during the authentication handshake. The disclosed credentials can subsequently be used to authenticate directly against the database server. Confidentiality is highly impacted — attackers can obtain user credentials in plaintext over unencrypted connections. Integrity and Availability are unaffected. The primary risk is credential disclosure, which could enable unauthorized access to the database server, potentially leading to further compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
