Details
-
Bug
-
Status: Closed (View Workflow)
-
Blocker
-
Resolution: Fixed
-
10.6(EOL), 10.11, 11.4, 11.8, 12.3
-
Can result in unexpected behaviour
-
-
Q3/2026 Replic. Maintenance
Description
MDEV-40027 reported one dynamic variable vulnerable to command injection on the donor node during State Snapshot Transfer (SST) operations. The pattern is general though, and other variables are likely affected. We need to analyze all dynamic variables & their usage in SST scripts to find which are affected.
Dynamic variables that reach the bash scripts
| Variable | Becomes (shell var) Via Consumed in scripts |
|---|---|
| wsrep_sst_method | script name wsrep_sst_<method> command name in all builders selects which of the four scripts runs |
| wsrep_sst_auth | WSREP_SST_OPT_AUTH → split into WSREP_SST_OPT_USER / WSREP_SST_OPT_PSWD WSREP_SST_AUTH_ENV env common.sh (split L1063-1083), mariabackup.sh, mysqldump.sh |
| wsrep_sst_receive_address | WSREP_SST_OPT_ADDR → HOST/PORT/MODULE/LSN/PATH joiner --address common.sh (parse L229-307), rsync.sh, mariabackup.sh, mysqldump.sh |
| wsrep_node_address | WSREP_SST_OPT_ADDR (same as above, joiner fallback when receive-address is AUTO) joiner --address common.sh, rsync.sh, mariabackup.sh, mysqldump.sh |
| wsrep_gtid_domain_id | WSREP_SST_OPT_GTID_DOMAIN_ID --gtid-domain-id %d common.sh (L436), mariabackup.sh, mysqldump.sh (numeric) |
Injection-relevant subset (string-valued, attacker-influenced text)
- wsrep_sst_method — validated filename_char ✅
- wsrep_sst_auth — validated shell_char ✅ (
MDEV-40027) - wsrep_sst_receive_address — validated address_char ✅
- wsrep_node_address — length-only, NOT charset-validated ❌ (the open gap; reaches joiner --address '%s' in the popen string)
- wsrep_gtid_domain_id is an integer sysvar, so not a text-injection vector.
Attachments
Issue Links
- relates to
-
-
- Closed
-
