Vitess allows HTML injection in /debug/querylogz & /debug/env
Medium4.9CVE-2024-53257 · Published Dec 3, 2024 · updated Aug 7, 2026
### Summary The `/debug/querylogz` and `/debug/env` pages for `vtgate` and `vttablet` do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. ### Details These pages are rendered using `text/template` instead of rendering with a proper HTML templating engine. ### PoC Execute any query where part of it is HTML markup, for example as part of a string. To make it easier to observe you might want to make sure the query takes a few seconds to complete, giving you time to refresh the status page. Example query that can trigger the issue: ```sql UPDATE users SET email = CONCAT("<img src=https://cataas.com/cat/says/oops>", users.idUser, "@xxx") WHERE email NOT LIKE '%xxx%' AND email != "demo@xxx.com" ``` Result:  ### Impact Anyone looking at the Vitess status page is affected. This would normally be owners / administrators of the Vitess cluster. Anyone that can influence what text show up in queries can trigger it. This would normally be pretty much everybody interacting with a system that uses Vitess as a bac...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vitess.io/vitess Go | >= 0.21.0-rc1, < 0.21.1 | 0.21.1 |
| >= 0.20.0-rc1, < 0.20.4 | 0.20.4 | |
| < 0.19.8 | 0.19.8 |
Details and references
### Summary The `/debug/querylogz` and `/debug/env` pages for `vtgate` and `vttablet` do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. ### Details These pages are rendered using `text/template` instead of rendering with a proper HTML templating engine. ### PoC Execute any query where part of it is HTML markup, for example as part of a string. To make it easier to observe you might want to make sure the query takes a few seconds to complete, giving you time to refresh the status page. Example query that can trigger the issue: ```sql UPDATE users SET email = CONCAT("<img src=https://cataas.com/cat/says/oops>", users.idUser, "@xxx") WHERE email NOT LIKE '%xxx%' AND email != "demo@xxx.com" ``` Result:  ### Impact Anyone looking at the Vitess status page is affected. This would normally be owners / administrators of the Vitess cluster. Anyone that can influence what text show up in queries can trigger it. This would normally be pretty much everybody interacting with a system that uses Vitess as a backend.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2024-53257, GO-2024-3306
More vitess advisories
All vitess| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 18 | Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data Medium5.3Aug 18 | Medium5.3 | No fix yet |
| Feb 27 | Vitess users with backup storage access can write to arbitrary file paths on restoreCriticalFeb 27 | Critical | 0.22.4+1 more |
| Feb 26 | Vitess users with backup storage access can gain unauthorized access to production deployment environmentsHighFeb 26 | High | No fix yet |
| May 82024 | Vitess vulnerable to infinite memory consumption and vtgate crashMedium4.9May 8, 2024 | Medium4.9 | 0.17.7+5 more |
| May 112023 | VTAdmin users that can create shards can deny access to other functionsMedium4.1May 11, 2023 | Medium4.1 | 0.16.2 |
| Apr 112023 | vitess allows users to create keyspaces that can deny access to already existing keyspacesMedium4.1Apr 11, 2023 | Medium4.1 | 0.16.1 |