In one sentence: Port 3306 is the door that applications use to talk to a MySQL database, and the manufacturer itself says it should not be reachable from untrusted computers.

What runs on this port

MySQL is a widely used open source database, and many websites and business apps store their data in it. The MySQL manual states that MySQL uses port 3306 by default.

The IANA registry lists mysql on TCP port 3306 and mysqlx, MySQL’s extended protocol, on TCP port 33060. Oracle’s port reference says the X Protocol port is the classic port multiplied by ten, which is 33060 by default.

Why attackers look for it

A database that answers on the internet invites password guessing and gives attackers direct access to the data store.

The MySQL manual is direct: try scanning your own ports from the internet with a tool such as nmap, because port 3306 should not be accessible from untrusted hosts. If you can connect and see some characters, the manual says the port is open and should be closed on your firewall or router unless you have a good reason to keep it open.

How it gets attacked

• No root password. The manual says that if you can connect with mysql -u root and are not asked for a password, anyone can connect as the root user with full privileges. It notes the server will allow root without a password if started with –initialize-insecure, which is a security risk.
• Too many privileges. The manual warns not to grant more privileges than needed or to grant privileges to all hosts.
• Plain text on the wire. The manual advises against transmitting unencrypted data over the internet.
• Authentication bypass. CVE-2012-2122: the National Vulnerability Database (NVD) records that certain MySQL and MariaDB versions, in certain environments, allowed remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password. The score is 5.1 on CVSS v2.

Who it affects and how badly

• Sole trader to 10 staff: a website with a database on a cheap server. Worst case: customer data stolen and the site defaced.
• 10 to 50 staff: estate agents, recruiters and retailers with online systems built on MySQL.
• 50 to 250 staff: SaaS start-ups and hospitality groups whose product is the database.
• Regulated businesses: an exposed database holding personal data is a likely personal data breach.

How to check whether yours is exposed

• Read firewall and cloud security group rules for inbound TCP 3306 and 33060.
• Follow the MySQL manual’s own test: from a remote machine you own, try to connect to the database host on port 3306. If it hangs or is refused, the port is blocked, which is what you want.
• Check the bind_address setting. The manual says 127.0.0.1 means MySQL listens only locally.
• Run SHOW GRANTS to review which accounts have what access.
• Run the free web vulnerability scan on the website that uses the database.

How to secure it

1. Close port 3306 to the internet, and allow only the application server.
2. Bind to 127.0.0.1 when the application runs on the same machine (MySQL manual).
3. Set a strong root password and never start the server with –initialize-insecure on a live system.
4. Grant each account only the privileges it needs, and never to all hosts (MySQL manual).
5. Use encrypted connections between application and database.
6. Do not store clear text passwords in the database. Store a salted hash (MySQL manual).
7. Fix application code so inputs are not trusted, as the manual says, and use parameterised queries.
8. Install MySQL updates, and back up with a tested restore.

Related terms

• port 1433 microsoft sql server
• sql injection
• brute force attack
• nmap
• patch management
• password spraying

Frequently asked questions

What port does MySQL use?
The MySQL manual states it uses port 3306 by default, and the X Protocol uses 33060.

Should port 3306 be open to the internet?
The MySQL manual says it should not be accessible from untrusted hosts.

How can I test whether my MySQL port is open?
The manual suggests trying to connect to the host on port 3306 from a remote machine you control. If it hangs or is refused, the port is blocked.

Sources

• MySQL 8.4 Reference Manual, security guidelines: https://dev.mysql.com/doc/refman/8.4/en/security-guidelines.html
• MySQL 8.4 Reference Manual, troubleshooting problems connecting: https://dev.mysql.com/doc/refman/8.4/en/problems-connecting.html
• NVD record for CVE-2012-2122 (MySQL and MariaDB authentication bypass): https://nvd.nist.gov/vuln/detail/CVE-2012-2122
• IANA service name and port number registry: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.