CVE-2014-4999

Vulnerability

The kajam gem version 1.0.3.rc2 for Ruby contains a vulnerability in the file vendor/plugins/dataset/lib/dataset/database/mysql.rb. In the capture function (line 18) and the restore function (line 24), the MySQL user password is passed as a command-line argument using --password=#{@password} to mysqldump and mysql commands. This allows any local user with the ability to list running processes to read the password from the process table [1] [3] [4].

Exploitation

An attacker must have local access to the system and the ability to list process command-line arguments (e.g., via ps or similar tools). No authentication or user interaction beyond local access is required. The password is visible in the process table while the capture or restore methods are executing, which can be triggered by any user of the gem or a Rails application using it [1] [3] [4].

Impact

Successful exploitation results in disclosure of the MySQL user password. This can lead to unauthorized database access, data breach, or further compromise of the database server. The attacker gains sensitive credential information without requiring elevated privileges [1] [3] [4].

Mitigation

No fixed version of the kajam gem has been released as of the available references. It is unclear if the gem is still maintained. Users should avoid using this gem, or modify the source code to pass the password via a file or environment variable instead of the command line. The CVE is not listed in KEV [1] [2] [3] [4].