Vitess vttablet /twopcz reflected XSS

From: xylove21 To: security@vitess.io Subject: [Security Report] Vitess vttablet /twopcz reflected XSS Date: Tue, 24 Jun 2026 14:30:00 +0800 ## Summary The `twopczHandler` in `go/vt/vttablet/tabletserver/twopcz.go` (line 185) reflects the `Action` and `dtid` form values directly into the HTML response body via `fmt.Fprintln(w, msg)` , **without HTML escaping**. The response is served as `text/html; charset=utf-8`, and Vitess's default `acl` policy is **allow-all**, so the endpoint is reachable by anyone who can hit the vttablet's HTTP port (default `15999`, multiplexed with gRPC and MySQL wire-protocol ports). A crafted `Action` or `dtid` value yields a **reflected XSS** that executes in the operator's browser with same-origin access to the vttablet's debug endpoints. This includes `/queryz` (live query plans), `/querylogz` (recent queries with bound values), `/txlogz` (transactions), `/debug/env` (environment variables , may include MySQL/topology credentials), `/debug/vars` (expvar stats), and `/debug/pprof/*` if enabled. The bug was introduced before v20.0.0 (long-standing) and was silently fixed in commit `3140c1846c` (merged 2026-06-09, PR #20255, "tabletserver: escape reflected form values in twopcz handler"). The fix replaces `fmt.Fprintln(w, msg)` with `fmt.Fprintln(w, html.EscapeString(msg))`. **No released version of Vitess contains the fix** , the fix lives only on `main` (current tip `33a3c0fafe69`, 2026-06-23). There is **no CVE, GHSA, or OSV entry** for this specific bug (verified 2026-06-24 against GitHub Advisory Database, OSV.dev, and NVD). ## Impact | Field | Value | |-------|-------| | **Type** | Reflected Cross-Site Scripting (XSS) | | **CVSS 3.1** | `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N` = **7.7 HIGH** | | **Attack Vector** | Network (vttablet HTTP port 15999, multiplexed with gRPC/MySQL) | | **Attack Complexity** | Low (craft URL, send to operator) | | **Privileges Required** | None (default `acl` policy is allow-all) | | **User Interaction** | Required (operator must visit crafted URL) | | **Scope** | Changed (XSS chain reaction to other vttablet debug endpoints) | | **Confidentiality** | High (query text, env vars, expvar stats) | | **Integrity** | None (XSS itself doesn't change state) | | **Availability** | None (XSS itself doesn't disrupt service) | ### Affected versions (verified) All released versions are vulnerable. The fix lives only on `main`: | Tag | Released | `twopcz.go` line 185 | Status | |---|---|---|---| | v20.0.0 | 2024-06-27 | `fmt.Fprintln(w, msg)` | **BUGGY** | | v20.0.1 - v20.0.6 | 2024 | `fmt.Fprintln(w, msg)` | **BUGGY** | | v22.0.4 | 2026-02-27 | `fmt.Fprintln(w, msg)` | **BUGGY** | | v23.0.3, v23.0.4 | 2026-02 / 2026-05 | `fmt.Fprintln(w, msg)` | **BUGGY** | | v24.0.0, v24.0.1 | 2026-04 / 2026-05 | `fmt.Fprintln(w, msg)` | **BUGGY** | | **main** (`33a3c0fafe69`) | 2026-06-23 | `fmt.Fprintln(w, html.EscapeString(msg))` | **FIXED** | ### Sensitive data exposed via the same-origin XSS chain A successful XSS lands in the vttablet's origin. From there, the attacker can fetch (via `fetch()` from injected JavaScript) the following same-origin endpoints, all of which are unauthenticated by default: - `/twopcz` , in-flight 2PC transactions (query text, parameters, dtid) - `/queryz` , live query plans - `/querylogz` , recent queries with bound values - `/txlogz` , transactions - `/debug/env` , environment variables (may include MySQL creds, topology credentials, encryption keys) - `/debug/vars` , expvar stats - `/debug/pprof/*` , CPU/memory profiles (if enabled) ## Reproduction (independent, runnable PoC) The PoC is a self-contained Go HTTP server that replicates the buggy `twopczHandler` from Vitess v20.0.0 verbatim (using the same line-185 code). It runs on `127.0.0.1:15080` and returns the same response shape as the real Vitess endpoint. ```bash # 1) Build the PoC (Go 1.23+) cd /path/to/finding/CVE-pending-twopcz-xss go build -o /tmp/vitess-twopcz-poc ./poc.go

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-116, CWE-79, CWE-80

Also known as

CVE-2026-104252

• github.com/vitessio/vitess/security/advisories/GHSA-v75v-6fpf-gvw8
• nvd.nist.gov/vuln/detail/CVE-2026-104252
• github.com/vitessio/vitess/pull/20255
• github.com/vitessio/vitess/pull/20273
• github.com/vitessio/vitess/pull/20274
• github.com/vitessio/vitess/commit/3140c1846cd120db34f33b2083139b4ab638aed2
• github.com/vitessio/vitess/commit/976e1e0d78f9d29d02e5e31b4aa7e180648f08af
• github.com/vitessio/vitess/commit/c1ed96302e658190168c971afdac730cf70e43f7
• github.com/vitessio/vitess
• github.com/vitessio/vitess/releases/tag/v23.0.5
• github.com/vitessio/vitess/releases/tag/v24.0.2