Apache Doris MCP Server SQL Injection (CVE-2025-66335)
Apache Doris MCP server takes SQL fragments supplied by a user or an AI agent and runs them without checking for malicious content. This lets an attacker sneak arbitrary SQL commands into what should be a controlled database query, potentially reading, changing, or deleting data.
How the attack works
An attacker crafts a tool call to the Doris MCP server, embedding SQL injection payloads inside arguments that are meant to hold simple values like table names or filter conditions. Because the server concatenates these arguments directly into the SQL it executes, the injected code runs with the same privileges as the legitimate query. This can be used to exfiltrate data, alter records, or drop tables, depending on the permissions of the database account the MCP server uses. The rule also flags MCP configurations pointing at Doris endpoints and content that describes this injection surface, since either can signal reconnaissance or setup for exploitation.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3b9332e3-e8ba-44eb-a078-099e14aaf522
- Severity
- Critical
- CVEs
- CVE-2025-66335
Why it matters
An organisation running an exposed or misconfigured Doris MCP server risks unauthorized read, modification, or destruction of database contents, including data an AI agent has access to on the organisation's behalf.
What you can do
- →Restrict which database accounts the Doris MCP server uses, applying least-privilege so injected queries can't read or modify unrelated data.
- →Validate and parameterize any SQL fragments passed through MCP tool arguments instead of concatenating raw input.
- →Review MCP server configurations for unintended exposure of Doris endpoints, especially to untrusted networks or agents.
- →Monitor tool call arguments for SQL injection patterns (e.g. UNION, comment sequences, stacked queries) targeting Doris-related tool names.
Known benign look-alikes
- Security scanning tooling that probes Doris MCP for SQL injection vulnerabilities.
- Educational content describing SQL injection in database MCP servers.
- Legitimate SQL queries containing UNION or subqueries for analytics.