📚 Confused deputy problem for databases: a method ofr privilege escalation in MariaDB

Author: MariaDB Foundation - Bewertung: 0x - Views:0

Operation systems had a confused deputy based privilege escalations for ages. But does it exist in a database? In the session I will demonstrate a number of cases where a simple select can be used to escalate a privilege inside the MariaDB database Alexander Rubin, Amazon Web Services Alexander is a Principal Security Engineerat Amazon Web Services (AWS), leading RDS Red Team. Alexander was working as MySQL principal consultant/architect for over 15 years, started with MySQL AB in 2006 (company behind MySQL database), Sun Microsystems, Oracle and then Percona. His security pentest/red teaming interest started with playing CTFs and performing opensource security research. Alexander is leading RDS (relational database as a service) Red Team at Amazon Web Services