CVE-2014-5004

Vulnerability

lib/brbackup.rb in the brbackup gem version 0.1.1 for Ruby passes the database password as a command-line argument to the mysql client. This exposes the password to any local user who can list running processes (e.g., via ps). The vulnerable code path is triggered when the gem executes a MySQL backup command. [1][3]

Exploitation

An attacker with local access to the system can run a process listing command (such as ps aux) and observe the full mysql command line, including the password argument. No authentication or special privileges are required beyond local shell access. [2][3]

Impact

Successful exploitation reveals the database password to the attacker. This can lead to unauthorized access to the database, enabling data theft, modification, or deletion. The compromise is limited to the privileges of the database user specified in the backup command. [1][3]

Mitigation

As of the available references, no patched version of the brbackup gem has been released to address this issue. The gem is in its early version (0.1.1) and may be unmaintained. Users should consider switching to an alternative backup solution that does not expose credentials on the command line. A workaround is to use a configuration file or environment variable for the password, which is not mentioned in the gem's code. [3][4]