Summary

An authenticated VTGate client with no special privileges can inject SQL into a validation query VTGate runs on a shard's mysqld by issuing a global-scope SET whose back-tick-quoted variable name cannot be a real system variable. The injected SQL runs on the backing MySQL as the tablet's application user, bypassing VTGate query routing and VTTablet table ACLs.

Details

A global-scope SET (SET @@global.x = ... or SET GLOBAL x = ...) is planned by planSysVarCheckIgnore (go/vt/vtgate/planbuilder/set.go) into an engine.SysVarCheckAndIgnore whose Name is taken directly from the statement:

return &engine.SysVarCheckAndIgnore{
    Name:              expr.Var.Name.Lowered(),
    ...
}

Unlike a session-scope variable, a global variable name is not looked up against the sysvars table, so nothing validates it. SysVarCheckAndIgnore.Execute (go/vt/vtgate/engine/set.go) then builds the validation probe and prints the name unescaped:

checkSysVarQuery := fmt.Sprintf("select 1 from dual where @@%s = %s", svci.Name, svci.Expr)

A back-tick-quoted identifier can contain any character, and the parser splits the global. scope prefix off inside the quotes, leaving the remainder as the variable name. The name is therefore attacker-controlled and is concatenated straight into the probe SQL.

PoC

Any client that can authenticate to VTGate.

SET @@`global.version = 1 union select sleep(5) -- ` = 1;

A planner/executor-level unit test on main (a sandbox tablet records the query VTGate sends) shows the injection:

QUERY SENT TO TABLET:
select 1 from dual where @@version = 1 union select sleep(5) --  = 1

SysVarCheckAndIgnore.Execute discards the probe's result and only logs its errors, so the single-statement primitive is a blind, time/boolean-based SELECT executing as the tablet's MySQL application user (data is inferred through response timing, as with sleep()). The tablet application-pool connection negotiates CLIENT_MULTI_STATEMENTS, so a name that keeps the first statement valid, such as version = 1; DROP TABLE t -- , additionally stacks arbitrary write and DDL statements, which run regardless of the discarded result. This bypasses VTGate routing and planning and VTTablet table ACLs.

Impact

Blind SQL execution as the tablet's MySQL application user, from any authenticated VTGate client, bypassing VTGate routing and VTTablet table ACLs. The single-statement primitive is a blind time/boolean-based read (confidentiality); multi-statement stacking extends it to arbitrary writes and DDL (integrity) and to expensive or destructive statements (availability). Where VTGate authentication is the tenant boundary, that boundary is broken for the targeted shard.

Patches

Fixed in v23.0.8 and v24.0.5 (#21390). VTGate now rejects a global SET whose variable name cannot be a MySQL system variable name: one identifier, or two joined by a single dot as in a component variable (validate_password.length) or a key cache variable (hot$cache.key_buffer_size), each made of letters, digits, underscores and dollar signs. Such a statement fails at planning time with VT05006 (MySQL error 1193, unknown system variable), as it does in MySQL, so the name never reaches a tablet. Every real global variable name still plans as before.

References

• Fix: #21390