Quick answers
- Is CVE-2017-16046 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2017-16046 being exploited in the wild.
- How severe is CVE-2017-16046?
- Low severity, with a CVSS score of 3.1, published 18 July 2018.
- Which products and versions are affected?
- mariadb (npm) SEMVER:introduced=0,last_affected=1.0.2.
- Is there a fix for CVE-2017-16046?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2017-16046 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2017-16046?
- Check whether you run mariadb (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability involves a malicious npm package masquerading as the legitimate MariaDB Node.js driver. The package contained code (CWE-506: Embedded Malicious Code) that automatically executes on installation to steal environment variables and exfiltrate them to attacker-controlled servers. No authentication or user interaction is required—the malware activates upon package installation as part of dependency resolution. An attacker can harvest sensitive credentials including database passwords, API keys, cloud tokens, and other secrets stored in environment variables. All affected versions (0–1.0.2) were unpublished from npm; the legitimate mariadb package is now owned and maintained by MariaDB.
Affected products
- npm mariadb 0–1.0.2
Identifiers
- CVE-2017-16046
- GHSA-85fq-56wq-gmcf
Timeline
- 2018-07-18: disclosed: Advisory published on GitHub Advisory Database
- 2024-04-19: other: Advisory withdrawn after legitimate MariaDB package ownership established