Summary
MariaDB Connector/Node.js incorrectly escapes quotes in text-protocol queries when the database session uses NO_BACKSLASH_ESCAPES. If an application passes attacker-controlled values through affected placeholder or escaping paths, the value may terminate a SQL string and inject additional SQL executed with the application's database privileges.
MariaDB Connector/Node.js incorrectly escapes quotes in text-protocol queries when the database session uses NO_BACKSLASH_ESCAPES. If an application passes attacker-controlled values through affected placeholder or escaping paths, the value may terminate a SQL string and inject additional SQL executed with the application's database privileges.
Affected context
The issue affects applications using MariaDB Connector/Node.js versions before the relevant fixed release lines when text-protocol escaping is used and the session has NO_BACKSLASH_ESCAPES enabled. That mode may be configured server-wide, supplied through connector initialization options, or enabled by application-issued SQL. The affected behavior includes placeholder handling and Connection.escape(); APIs using binary protocols, such as execute() and batch(), are not affected by this specific escaping flaw.
The issue affects applications using MariaDB Connector/Node.js versions before the relevant fixed release lines when text-protocol escaping is used and the session has NO_BACKSLASH_ESCAPES enabled. That mode may be configured server-wide, supplied through connector initialization options, or enabled by application-issued SQL. The affected behavior includes placeholder handling and Connection.escape(); APIs using binary protocols, such as execute() and batch(), are not affected by this specific escaping flaw.
Exploit preconditions
- Attack surface: Application-generated SQL statements that use the connector's text protocol
- Required access: Ability to influence a value incorporated through an affected placeholder or escaping path
- Trigger point: Processing the attacker-controlled value while
NO_BACKSLASH_ESCAPESis active - Why exploitation is possible: The connector emits backslash-prefixed quote escapes without accounting for the session's SQL mode, allowing a quote to be interpreted as the end of a string literal
- Execution context: Any injected SQL runs with the privileges of the application's database account
- Attack surface: Application-generated SQL statements that use the connector's text protocol
- Required access: Ability to influence a value incorporated through an affected placeholder or escaping path
- Trigger point: Processing the attacker-controlled value while
NO_BACKSLASH_ESCAPESis active - Why exploitation is possible: The connector emits backslash-prefixed quote escapes without accounting for the session's SQL mode, allowing a quote to be interpreted as the end of a string literal
- Execution context: Any injected SQL runs with the privileges of the application's database account
Why this happens
The connector's text-protocol escaping logic assumes that backslashes retain their escape semantics in the active SQL session. Under NO_BACKSLASH_ESCAPES, a backslash is treated as an ordinary character, so quote escaping is ineffective and attacker-controlled text can alter the structure of a SQL statement.
This is CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The underlying insecure pattern is relying on client-side escaping that is not synchronized with server-side parsing rules, rather than using a protocol or API that keeps data separate from SQL syntax.
The connector's text-protocol escaping logic assumes that backslashes retain their escape semantics in the active SQL session. Under NO_BACKSLASH_ESCAPES, a backslash is treated as an ordinary character, so quote escaping is ineffective and attacker-controlled text can alter the structure of a SQL statement.
This is CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The underlying insecure pattern is relying on client-side escaping that is not synchronized with server-side parsing rules, rather than using a protocol or API that keeps data separate from SQL syntax.
Potential impact
- An attacker may read or modify data accessible to the application account.
- An attacker could bypass intended query restrictions or authorization logic.
- Database records, schemas, or stored data may be altered or deleted.
- Sensitive information may be disclosed through query results or side effects.
- In some deployments, database-level compromise could enable further access to connected systems.
- An attacker may read or modify data accessible to the application account.
- An attacker could bypass intended query restrictions or authorization logic.
- Database records, schemas, or stored data may be altered or deleted.
- Sensitive information may be disclosed through query results or side effects.
- In some deployments, database-level compromise could enable further access to connected systems.
General mitigation guidance
Mitigation generally focuses on preserving a strict separation between SQL code and application data.
Common defensive patterns include:
- Prefer parameterized APIs that use binary-protocol execution where supported.
- Avoid constructing SQL through manual concatenation or generic client-side escaping.
- Ensure escaping behavior and session SQL modes are explicitly aligned when text-protocol queries are unavoidable.
- Treat database configuration and connector options as security-sensitive inputs.
- Use database accounts with only the permissions required by each application function.
- Apply authorization checks at the application and database layers, and limit access to sensitive tables and operations.
- Add regression tests covering relevant SQL modes and attacker-controlled string values.
Mitigation generally focuses on preserving a strict separation between SQL code and application data.
Common defensive patterns include:
- Prefer parameterized APIs that use binary-protocol execution where supported.
- Avoid constructing SQL through manual concatenation or generic client-side escaping.
- Ensure escaping behavior and session SQL modes are explicitly aligned when text-protocol queries are unavoidable.
- Treat database configuration and connector options as security-sensitive inputs.
- Use database accounts with only the permissions required by each application function.
- Apply authorization checks at the application and database layers, and limit access to sensitive tables and operations.
- Add regression tests covering relevant SQL modes and attacker-controlled string values.
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis rules identifying SQL construction through concatenation or escaping APIs instead of parameterized execution.
- Code review signals such as use of
Connection.escape()for security boundaries, text-protocol query generation, or assumptions that backslashes always escape quotes. - Configuration audits for
NO_BACKSLASH_ESCAPESenabled at the server, connector, or application session level. - Database activity monitoring for unexpected statements, unusual query structures, privilege-sensitive operations, or anomalous access to sensitive data.
- Policy enforcement requiring parameterized queries and least-privilege database accounts.
Automated code-review and dependency-analysis tools may help identify affected connector usage patterns and unsafe query construction.
Organizations can look for this issue through:
- Static analysis rules identifying SQL construction through concatenation or escaping APIs instead of parameterized execution.
- Code review signals such as use of
Connection.escape()for security boundaries, text-protocol query generation, or assumptions that backslashes always escape quotes. - Configuration audits for
NO_BACKSLASH_ESCAPESenabled at the server, connector, or application session level. - Database activity monitoring for unexpected statements, unusual query structures, privilege-sensitive operations, or anomalous access to sensitive data.
- Policy enforcement requiring parameterized queries and least-privilege database accounts.
Automated code-review and dependency-analysis tools may help identify affected connector usage patterns and unsafe query construction.
