Exasol Database 7.1.30 docker-db default SYS credential enables command execution
Original title: [0day-rubbish] Exasol Database 7.1.30 docker-db form: shipped default SYS credential to PYTHON3 UDF os.popen command execution as uid=500(exadefusr), output returned in-band (8.8)
The docker-db image ships a default SYS credential that reaches os.popen through a PYTHON3 UDF.
0day Rubbish Research Team disclosed a flaw in Exasol Database 7.1.30, examined in its docker-db single-container form. Exasol AG makes the in-memory analytical database; its SQL engine is the proprietary EXASolution process exacts, and clients use a binary SQL protocol on port 8563. The disclosure says a shipped default SYS credential can reach PYTHON3 UDF command execution. No fix is stated in the snippet.
Unconfirmed: The snippet is truncated and does not confirm a CVE, patch, or attacks using the default credential.
- Commands run as uid=500(exadefusr), with output returned in-band.
- The disclosure title rates the issue 8.8.
- TLS on port 8563 uses a self-signed certificate, the snippet says.
- The finding is limited to the docker-db deployment form described.
Impact: command execution as uid=500 via default SYS credential
| Product | Affected |
|---|---|
| Exasol AG Exasol Database | 7.1.30 docker-db |
- Vendors
- Exasol AG
- Products
- Exasol Database
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in Exasol Database 7. 1. 30, the in-memory MPP analytical database from Exasol AG (Germany), examined in its docker-db single-container deployment form.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.