Cloudanix VulnDB

CVE-2017-6410

Medium · 5.5

CVSS

5.5

EPSS

0.9%

Published

Mar 2, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain network configuration handling could let attackers see private login details sent over the internet when specific setup files are used.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw passes full HTTPS URLs, including potential Basic Auth credentials, query strings or PATH_INFO, to the PAC FindProxyForURL function, allowing a crafted PAC file to capture and exfiltrate sensitive information.

Why it matters to the business

Attackers may obtain credentials or other sensitive data from affected systems, increasing risk of unauthorized access; the issue affects widely used MySQL packages and has remained unpatched for years in many environments.

How an attack unfolds

An attacker supplies a malicious PAC file to the vulnerable KDE kio or kdelibs component used by the affected MySQL packages; when the component resolves a proxy for an HTTPS URL the full URL (with credentials) is passed to FindProxyForURL and the attacker-controlled PAC can log or transmit the data.

How to fix it

Upgrade mysql-8.0, mysql-8.0-dev, mysql-8.0-oci-entrypoint, mysql-8.0-oci-entrypoint-compat and mysql-8.0-client to version 8.0.38-r0 or later; remove or disable use of untrusted PAC files until patches are applied.

How to confirm the fix worked

Verify installed package versions match the fixed releases listed for each Chainguard MySQL variant; test proxy resolution with a crafted PAC containing a URL that includes test credentials and confirm the credentials are no longer exposed.

Typical attack path

  1. Position a malicious PAC file reachable by the target system
  2. Trigger proxy resolution for an HTTPS URL containing sensitive information
  3. Capture the full URL passed to FindProxyForURL
  4. Extract credentials or other data from the captured URL

How to detect it

Review system and application logs for proxy resolution events that include full HTTPS URLs; inspect any PAC files loaded by the affected components and search for unexpected outbound connections carrying URL data.

What your security team should do

  • Immediately upgrade all listed MySQL packages to the fixed versions
  • Audit environments for any use of external or untrusted PAC files
  • Monitor EPSS trend and re-evaluate if exploit maturity changes
  • Add package version checks to CI/CD and container scanning pipelines

The record

kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 kio 0 5.28.0-2
Debian:12 kio 0 5.28.0-2
Debian:13 kio 0 5.28.0-2
Debian:7 kde4libs 0 4:4.8.4-4+deb7u3
Debian:8 kde4libs 0 4:4.14.2-5+deb8u2
Mageia:5 kdelibs4 0 4.14.30-1.mga5
SUSE:Package Hub 12 SP1 kdelibs4 0 4.14.25-5.3
SUSE:Package Hub 12 SP1 kdelibs4-apidocs 0 4.14.25-5.3
SUSE:Package Hub 12 SP1 kio 0 5.26.0-5.1
SUSE:Package Hub 12 SP2 kdelibs4 0 4.14.25-5.3
SUSE:Package Hub 12 SP2 kdelibs4-apidocs 0 4.14.25-5.3
SUSE:Package Hub 12 SP2 kio 0 5.26.0-5.1
Ubuntu:14.04:LTS kde4libs 0 4:4.13.3-0ubuntu0.4
Ubuntu:16.04:LTS kde4libs 0 4:4.14.16-0ubuntu3.1
Ubuntu:16.04:LTS kio 0 5.18.0-0ubuntu1.1

Related vulnerabilities