Neuron MySQLSelectTool “只读”绕过，通过`SELECT ... INTO OUTFILE` (文件写入 → 潜在的RCE)

The MySQLSelectTool component, designed for read-only SQL queries, suffers from inadequate input validation. While intended to block malicious SQL commands, the validation mechanism fails to prevent file-writing constructs like INTO OUTFILE or INTO DUMPFILE. This flaw allows an attacker who can influence the tool's input – for example, through prompt injection in a public agent endpoint – to write arbitrary content to files on the database server. The severity of this vulnerability is amplified if the MySQL/MariaDB account possesses the FILE privilege and the server configuration permits writes to a publicly accessible directory, such as a web server's document root. Successful exploitation could lead to remote code execution, data exfiltration, and complete system takeover.

Organizations deploying neuron-core/neuron-ai with publicly accessible agent endpoints are particularly at risk. This includes those utilizing the tool for LLM agent querying and those who have granted the MySQL/MariaDB account the FILE privilege. Shared hosting environments where multiple users share the same database server are also vulnerable, as a compromised agent could impact other users' data.

• php: Examine application logs for SQL queries containing INTO OUTFILE or INTO DUMPFILE. • php: Use grep to search for instances of MySQLSelectTool in the codebase, particularly where user input is directly incorporated into SQL queries. • generic web: Monitor web server access logs for requests containing suspicious SQL syntax or attempts to access files outside the intended scope. • database (mysql): Execute SHOW GRANTS FOR 'yourmysqluser'@'%'; to verify the FILE privilege is not granted. If it is, revoke it using REVOKE FILE ON . FROM 'yourmysqluser'@'%';

1. 2025-12-09Disclosure

   disclosure

2. 2025-12-09Patch

   patch

1. 已保留2025-12-08
2. 发布日期2025-12-09
3. 修改日期2025-12-11
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-67509 is to upgrade to neuron-core/neuron-ai version 2.8.12 or later, which includes the necessary input validation fixes. If immediate upgrading is not feasible, consider implementing temporary workarounds. Restrict the MySQL/MariaDB account's privileges, specifically revoking the FILE privilege. Configure the database server to prevent writes to publicly accessible directories. Implement a Web Application Firewall (WAF) or proxy to filter potentially malicious SQL queries, specifically targeting INTO OUTFILE and INTO DUMPFILE statements. After upgrading, confirm the fix by attempting a controlled injection of a SELECT ... INTO OUTFILE statement through the agent endpoint and verifying that the file write is blocked.

最后更新

3.14.4最近