The vulnerability stems from the MariaDB Connector/Node.js not enforcing a secure transport (TLS or a local socket) for the PAM (dialog) authentication method. This method inherently transmits the user's password in cleartext. An attacker on the network (Man-in-the-Middle) could intercept the connection setup and, by requesting PAM authentication, trick the client into sending the password over an unencrypted TCP connection.
The analysis of the patches shows that the fix involves two main parts. First, a new method, requireSecure(), was added to the authentication plugin base class and implemented in PamPasswordAuth to signal that it requires a secure connection. Second, the Authentication.start function, which orchestrates the authentication process, was modified to call this new method and abort the connection if a secure transport is required but not active. The vulnerable functions are therefore Authentication.start, for failing to perform this check, and PamPasswordAuth.start, which is the function that ultimately sends the sensitive data over the insecure channel.
Miggo AI
