# MySQL Remote Access Misconfiguration

- **URL:** https://hackindex.io/services/mysql/vulnerability-discovery/mysql-remote-access-misconfiguration
- **Path:** MySQL > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/mysql/vulnerability-discovery.md)
- **Published:** 2026-03-26
- **Updated:** 2026-03-29

MySQL is intended to be accessed from the application server on the same host or internal network. When it is bound to a public interface and user accounts allow connections from any host (`%`), the database is directly reachable from the internet or from any system on the network segment. Combined with weak or default credentials this is immediately exploitable. Even with strong credentials, network exposure of MySQL is a misconfiguration worth documenting: it reduces the attack surface from requiring application-layer compromise to requiring only credential access.

## Confirm Network Exposure

Check whether port 3306 responds from outside the host:

```bash
nmap -sV -p ${PORT:-3306} $TARGET_IP
# PORT     STATE SERVICE VERSION
# 3306/tcp open  mysql   MySQL 8.0.32 MySQL Community Server
```

A responding MySQL service on a public or DMZ IP address confirms the instance is network-exposed. Compare the target IP against the expected internal network range: a database responding on a public IP is a higher severity finding than one on an internal subnet.

## Check the Bind Address

Once connected, confirm what interface MySQL is bound to:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW VARIABLES LIKE 'bind_address';"
# +---------------+-------+
# | Variable_name | Value |
# +---------------+-------+
# | bind_address  | *     |
# +---------------+-------+
```

`bind_address = *` or `0.0.0.0` confirms MySQL is listening on all interfaces. `bind_address = 127.0.0.1` or a specific internal IP means it is locally or network-restricted: you reached it through a tunnel or pivot rather than direct exposure.

## Check User Account Host Restrictions

MySQL user accounts include a host field that restricts which source addresses can authenticate. Check whether accounts allow connections from any host:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT user, host, plugin FROM mysql.user ORDER BY host;"
# +------------------+------+-----------------------+
# | user             | host | plugin                |
# +------------------+------+-----------------------+
# | root             | %    | caching_sha2_password |
# | app_user         | %    | mysql_native_password |
# | debian-sys-maint | localhost | caching_sha2_password |
# +------------------+------+-----------------------+
```

Accounts with `host = %` accept connections from any IP address. A root account with `host = %` on a network-exposed instance means root-level database access is available from anywhere with the correct password. This is a critical finding regardless of password strength: the attack surface extends to the entire internet or network.

## Verify on the Host if Shell Access is Available

If shell access is available on the database host, confirm the listening address from the OS side:

```bash
ss -tlnp | grep 3306
# LISTEN  0  151  0.0.0.0:3306  0.0.0.0:*  users:(("mysqld",pid=1482,fd=24))
```

```bash
grep -iE 'bind.address|skip.networking' /etc/mysql/mysql.conf.d/mysqld.cnf 2>/dev/null || grep -iE 'bind.address|skip.networking' /etc/my.cnf 2>/dev/null
# bind-address = 0.0.0.0
```

## Document the MySQL Remote Access Misconfiguration

Record the following for the finding:

- The bind address and whether it is on a public or internal interface
- Which user accounts allow connections from `%` (any host)
- Whether any of those accounts have weak or empty passwords
- Whether the instance is internet-facing or internal network only

A publicly exposed MySQL instance with accounts allowing `%` host connections is directly accessible for credential-based attacks. Brute-force and default credential testing are covered in the exploitation phase.

## References

- [MySQL: bind_address variable](https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_bind_address) - Interface binding configuration and wildcard behavior reference
- [MySQL: Access control and account management](https://dev.mysql.com/doc/refman/8.0/en/connection-access.html) - Host field matching behavior in user account definitions