CVE-2017-14478
📋 TL;DR
CVE-2017-14478 is a critical command injection vulnerability in MySQL Multi-Master Replication Manager (MMM) agent that allows remote unauthenticated attackers to execute arbitrary commands with mmm_agentd process privileges. This affects Linux systems running mmm_agentd version 2.2.1. Attackers can exploit this by sending specially crafted MMM protocol messages over TCP.
💻 Affected Systems
- MySQL Multi-Master Replication Manager (MMM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, lateral movement, and persistent backdoor installation with root privileges if mmm_agentd runs as root.
Likely Case
Remote code execution allowing attackers to steal database credentials, modify replication settings, or disrupt database operations.
If Mitigated
Limited impact if mmm_agentd runs with minimal privileges and network access is restricted.
🎯 Exploit Status
Exploitation is straightforward - requires sending a specially crafted TCP packet to the mmm_agentd port (default 9988). Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.2 and later
Vendor Advisory: https://github.com/mysql-mmm/mysql-mmm
Restart Required: Yes
Instructions:
1. Stop mmm_agentd service. 2. Upgrade to MMM version 2.2.2 or later. 3. Restart mmm_agentd service. 4. Verify the service is running correctly.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to mmm_agentd port using firewall rules
iptables -A INPUT -p tcp --dport 9988 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 9988 -j DROP
Service Isolation
linuxRun mmm_agentd with minimal privileges and in isolated environment
useradd -r -s /bin/false mmmagent
chown -R mmmagent:mmmagent /etc/mysql-mmm/
sed -i 's/^USER=.*/USER=mmmagent/' /etc/init.d/mmm_agentd
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to block all unauthorized access to port 9988
- Monitor mmm_agentd process activity and network connections for suspicious behavior
🔍 How to Verify
Check if Vulnerable:
Check MMM version: mmm --version | grep '^mmm agent' and verify if it's 2.2.1Check Version:
mmm --version | grep '^mmm agent'Verify Fix Applied:
Verify version is 2.2.2 or later: mmm --version | grep '^mmm agent'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in mmm_agentd logs
- Failed authentication attempts or protocol errors
- Unexpected process spawns from mmm_agentd
Network Indicators:
- TCP connections to port 9988 from unauthorized sources
- Unusual network traffic patterns to mmm_agentd port
SIEM Query:
source="mmm_agentd.log" AND ("command injection" OR "unexpected command" OR "protocol error")