Summary
MariaDB inconsistently quotes identifiers and values when generating SQL through SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump. A low-privileged attacker may poison an object so that generated output contains injected SQL, which can execute when the output is later applied.
MariaDB inconsistently quotes identifiers and values when generating SQL through SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump. A low-privileged attacker may poison an object so that generated output contains injected SQL, which can execute when the output is later applied.
Affected context
The vulnerability occurs in MariaDB installations where attacker-created objects can be included in SHOW output or logical database dumps. It becomes risky when generated SQL is trusted and subsequently executed without independent validation, allowing crafted identifiers or values to cross the serialization boundary as executable statements.
The vulnerability occurs in MariaDB installations where attacker-created objects can be included in SHOW output or logical database dumps. It becomes risky when generated SQL is trusted and subsequently executed without independent validation, allowing crafted identifiers or values to cross the serialization boundary as executable statements.
Exploit preconditions
- Attack surface: MariaDB SQL serialization through SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump
- Required access: Low-privileged ability to create or modify database objects whose identifiers or values are serialized
- Trigger point: Generation and later application of poisoned SHOW output or dump content
- Why exploitation is possible: Identifiers and values are not consistently quoted, allowing attacker-controlled content to be interpreted as additional SQL statements
- Attack surface: MariaDB SQL serialization through SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump
- Required access: Low-privileged ability to create or modify database objects whose identifiers or values are serialized
- Trigger point: Generation and later application of poisoned SHOW output or dump content
- Why exploitation is possible: Identifiers and values are not consistently quoted, allowing attacker-controlled content to be interpreted as additional SQL statements
Why this happens
The underlying bug is incomplete escaping and quoting during conversion of database metadata into executable SQL text. When identifiers or values are serialized without context-appropriate quoting, attacker-controlled content can break out of its intended syntactic position and introduce new SQL statements. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
The underlying bug is incomplete escaping and quoting during conversion of database metadata into executable SQL text. When identifiers or values are serialized without context-appropriate quoting, attacker-controlled content can break out of its intended syntactic position and introduce new SQL statements. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL injection.
Potential impact
- Unauthorized SQL statements may be executed when poisoned output is applied
- Database contents or schema may be altered
- Sensitive information may be exposed or modified
- Administrative or operational workflows may be disrupted
- Data integrity and backup or migration reliability may be compromised
- Unauthorized SQL statements may be executed when poisoned output is applied
- Database contents or schema may be altered
- Sensitive information may be exposed or modified
- Administrative or operational workflows may be disrupted
- Data integrity and backup or migration reliability may be compromised
General mitigation guidance
Mitigation generally focuses on treating serialized SQL as a security-sensitive output format rather than inherently trusted text.
Common defensive patterns include:
- Apply context-appropriate quoting and escaping to every serialized identifier and value
- Prefer structured metadata or parameterized execution paths over concatenated SQL where practical
- Validate generated SQL before applying dumps or SHOW-derived output
- Reduce trust in objects and metadata created by low-privileged accounts
- Run import, migration, and administrative workflows with only the privileges they require
- Keep generated dumps protected from unauthorized modification and review them before execution
Mitigation generally focuses on treating serialized SQL as a security-sensitive output format rather than inherently trusted text.
Common defensive patterns include:
- Apply context-appropriate quoting and escaping to every serialized identifier and value
- Prefer structured metadata or parameterized execution paths over concatenated SQL where practical
- Validate generated SQL before applying dumps or SHOW-derived output
- Reduce trust in objects and metadata created by low-privileged accounts
- Run import, migration, and administrative workflows with only the privileges they require
- Keep generated dumps protected from unauthorized modification and review them before execution
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules that identify SQL generation using unescaped identifiers or values
- Code review checks for inconsistent quoting across SHOW, dump, export, and migration serializers
- Tests using metacharacters and statement delimiters in object names and metadata values
- Policy enforcement requiring validation or review before generated SQL is executed
- Monitoring for unexpected statements in dump-import and administrative execution workflows
Automated security and code review tools may help identify unsafe string-construction patterns, but database-specific serialization tests remain important.
Organizations can look for this weakness through:
- Static analysis rules that identify SQL generation using unescaped identifiers or values
- Code review checks for inconsistent quoting across SHOW, dump, export, and migration serializers
- Tests using metacharacters and statement delimiters in object names and metadata values
- Policy enforcement requiring validation or review before generated SQL is executed
- Monitoring for unexpected statements in dump-import and administrative execution workflows
Automated security and code review tools may help identify unsafe string-construction patterns, but database-specific serialization tests remain important.
