CVE-2014-4991

Vulnerability

The codders-dataset gem version 1.3.2.1 for Ruby places database credentials on the mysqldump command line in lib/dataset/database/mysql.rb and lib/dataset/database/postgresql.rb [1][2]. Specifically, the @password variable is passed as a command-line argument (e.g., --password=#{@password}) without proper sanitization, making the plaintext password visible in the system's process table [4]. Both MySQL and PostgreSQL database backends are affected [1][4].

Exploitation

An attacker with local access to the system can list running processes (e.g., using ps or /proc) to view the command-line arguments of the mysqldump process, thereby capturing the database credentials [1][2]. No authentication or special privileges beyond local user access are required; the attacker simply needs to observe processes at the moment the gem executes the database dump [4].

Impact

Successful exploitation results in disclosure of the database username and password, leading to loss of confidentiality of database credentials [1][2]. An attacker who obtains these credentials can then access the database with the same privileges as the compromised user, potentially reading, modifying, or deleting data [4].

Mitigation

As of the available references, no official patch or updated version of the codders-dataset gem has been released to address this vulnerability [1][2]. The gem's GitHub repository does not indicate a fix [3]. Users should avoid using this gem for database operations that require passing credentials on the command line, or switch to alternative tools that use secure methods (e.g., configuration files with restricted permissions) for credential handling.