GHSA-5rqc-86vf-g8r2: SQL Injection
Summary
The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data corruption and a client/server charset-confusion mismatch.
Details
The driver encodes and decodes all character data on the assumption that the connection character set is UTF-8. The server can, however, announce a change of charactersetclient mid-session through the OK-packet session-state-tracking mechanism, for example via a SET NAMES … run by a stored routine or trigger, by server configuration, or by a hostile server.
If the new charset is not UTF-8, the driver continues to read and write UTF-8 while the server interprets the same bytes under a different encoding. The result is silent data corruption and a client/server charset-confusion mismatch. Charset confusion of this kind is also the primitive that can defeat byte-wise quoting/escaping when client and server disagree on a multi-byte encoding.
Am I affected?
You are affected if you use mariadb Connector/R2DBC (org.mariadb:r2dbc-mariadb) below 1.4.1 and a connection can be steered, by a hostile or man-in-the-middle server, or by server-side state such as a stored routine, trigger, or configuration — to switch charactersetclient to a non-UTF-8 value mid-session.
Impact
Silent data corruption and a client/server encoding mismatch once the connection's charset diverges from UTF-8. Because the mismatch undermines the assumption that quoting/escaping operates on UTF-8 bytes, it belongs to the charset-confusion class that can lead to SQL injection.
Patches
Fixed in 1.4.1. Once the connection is fully initialized, any subsequent charset change to a value that is not utf8 / utf8mb3 / utf8mb4 is rejected: the driver raises R2dbcNonTransientResourceException (SQLState 08000) and closes the connection rather than continuing to exchange data under a mismatched encoding. Upgrade to 1.4.1 or later.
Workarounds
There is no reliable application-level workaround; upgrade to 1.4.1 or later.
Credit
Reported by Yalguun Tumenkhuu (@fg0x0).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.mariadb:r2dbc-mariadbto a version that resolves this vulnerability.Fixed in 1.4.1 - Upgrade
Upgrade
org.mariadb:r2dbc-mariadbto a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Frequently Asked Questions
What conditions can cause the client and server to disagree on character encoding?
The condition occurs when the server changes character_set_client during an active session to a non-UTF-8 charset. This can result from SET NAMES executed by a stored routine or trigger, server configuration, or a hostile server.
What is the practical impact of an encoding mismatch?
It can silently corrupt character data because the driver continues using UTF-8 while the server interprets the bytes using a different encoding. The mismatch can also undermine byte-wise quoting or escaping when a multi-byte encoding is involved.
Which deployments should investigate this issue?
Deployments using mariadb Connector/R2DBC should investigate whether their server can change character_set_client mid-session. Environments using stored routines, triggers, server-side charset configuration, or untrusted servers are specifically relevant.