CVE-2023-38699
📋 TL;DR
MindsDB versions before 23.7.4.0 had disabled SSL certificate verification in requests, allowing man-in-the-middle attacks to intercept and potentially modify data between MindsDB and external data sources. This affects all users of MindsDB who connect to external data sources over HTTPS.
💻 Affected Systems
- MindsDB
📦 What is this software?
Mindsdb by Mindsdb
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept sensitive data (credentials, PII, proprietary data) being transmitted between MindsDB and external data sources, or inject malicious data/responses.
Likely Case
Data interception leading to information disclosure of whatever data MindsDB is processing from external sources.
If Mitigated
With proper SSL verification enabled, all HTTPS connections are properly authenticated and encrypted.
🎯 Exploit Status
Exploitation requires network position to perform MITM attacks; no authentication bypass needed as this is a transport layer vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.7.4.0
Vendor Advisory: https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw
Restart Required: Yes
Instructions:
1. Update MindsDB to version 23.7.4.0 or later using pip: pip install --upgrade mindsdb>=23.7.4.0
2. Restart the MindsDB service/application
3. Verify SSL verification is enabled in all requests
🔧 Temporary Workarounds
Environment variable enforcement
linuxSet environment variable to enforce SSL verification for Python requests
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
Network segmentation
allIsolate MindsDB instances from untrusted networks to reduce MITM risk
🧯 If You Can't Patch
- Deploy network monitoring/IDS to detect MITM attempts on MindsDB traffic
- Use VPNs or dedicated secure channels for all external data source connections
🔍 How to Verify
Check if Vulnerable:
Check MindsDB version: if version < 23.7.4.0, it's vulnerable. Also check if any custom code uses requests with verify=False.Check Version:
python -c "import mindsdb; print(mindsdb.__version__)" or check package metadataVerify Fix Applied:
After updating, test HTTPS connections to external sources fail with invalid certificates (as expected with proper SSL verification).📡 Detection & Monitoring
Log Indicators:
- Failed SSL handshakes after patching (expected)
- Unusual external connection patterns
Network Indicators:
- MITM detection via certificate validation failures
- Unencrypted traffic where HTTPS expected
SIEM Query:
source="mindsdb" AND (event="connection_error" OR event="ssl_error")🔗 References
- https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b
- https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw
- https://github.com/mindsdb/mindsdb/commit/083afcf6567cf51aa7d89ea892fd97689919053b
- https://github.com/mindsdb/mindsdb/releases/tag/v23.7.4.0
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-8hx6-qv6f-xgcw
