{"id":"CVE-2024-53257","aliases":["AZL-53970","AZL-53977","EUVD-2024-3445","GHSA-7mwh-q3xm-qh6p","GO-2024-3306","openSUSE-SU-2024:14599-1"],"status":"published","title":"Vitess allows HTML injection in /debug/querylogz \u0026 /debug/env","description":"Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00439,"percentile":0.38616,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-12-03T15:46:40Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Go","package":"vitess.io/vitess","fixed_in":["0.21.1","0.20.4","0.19.8"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"vitess","fixed_in":["19.0.4-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vitess","fixed_in":["17.0.7-7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21.0-rc1"},{"fixed":"0.21.1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.20.0-rc1"},{"fixed":"0.20.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.8"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.0.4-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vitess","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.7-7"}]}]},{"source":"osv","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"introduced":"0.21.0-rc1"},{"fixed":"0.21.1"}]}]},{"source":"osv","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.0-rc1"},{"fixed":"0.20.4"}]}]},{"source":"osv","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.8"}]}]},{"source":"osv","ecosystem":"Go","package":"vitess.io/vitess","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.8"},{"introduced":"0.20.0"},{"fixed":"0.20.4"},{"introduced":"0.21.0"},{"fixed":"0.21.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20241213T205935-1.1"}]}],"bundled":21}],"products":[{"vendor":"vitessio","product":"vitess"}],"references":[{"url":"https://github.com/vitessio/vitess/security/advisories/GHSA-7mwh-q3xm-qh6p","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vitessio/vitess/commit/2b71d1b5f8ca676beeab2875525003cd45096217","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53257","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-7mwh-q3xm-qh6p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53257.json","tags":["advisory"]},{"url":"https://github.com/vitessio/vitess","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QTUY324RV3FFZBHVIWDHRCIOPJHIJIN4/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55660","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-53257","title":"Vitess allows HTML injection in /debug/querylogz \u0026 /debug/env","description":"Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.","status":"published","published":"2024-12-03T15:46:40.513Z","modified":"2024-12-03T16:57:59.604Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:17.523201Z"}],"euvd":[{"id":"EUVD-2024-3445","description":"Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.","status":"published","published":"2024-12-03T15:46:40Z","modified":"2024-12-03T16:57:59Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:42.176683Z"}],"ghsa":[{"id":"GHSA-7mwh-q3xm-qh6p","title":"Vitess allows HTML injection in /debug/querylogz \u0026 /debug/env","description":"### Summary\n\nThe `/debug/querylogz` and `/debug/env` pages for `vtgate` and `vttablet` do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will.\n\n### Details\n\nThese pages are rendered using `text/template` instead of rendering with a proper HTML templating engine.\n\n### PoC\n\nExecute any query where part of it is HTML markup, for example as part of a string. To make it easier to observe you might want to make sure the query takes a few seconds to complete, giving you time to refresh the status page. \n\nExample query that can trigger the issue:\n\n```sql\nUPDATE users\nSET\n    email = CONCAT(\"\u003cimg src=https://cataas.com/cat/says/oops\u003e\", users.idUser, \"@xxx\")\nWHERE\n    email NOT LIKE '%xxx%' AND email != \"demo@xxx.com\"\n```\n\nResult: \n\n![image](https://github.com/user-attachments/assets/c583816b-157c-474e-bbed-152b3dc0372f)\n\n### Impact\n\nAnyone looking at the Vitess status page is affected. This would normally be owners / administrators of the Vitess cluster.\n\nAnyone that can influence what text show up in queries can trigger it. This would normally be pretty much everybody interacting with a system that uses Vitess as a backend.","status":"published","published":"2024-12-03T18:43:33Z","modified":"2024-12-16T15:26:05Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:25.334027Z"}],"nvd":[{"id":"CVE-2024-53257","description":"Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.","status":"published","published":"2024-12-03T16:15:23.693Z","modified":"2026-06-17T08:08:42.213Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:38.973941Z"}],"osv":[{"id":"CVE-2024-53257","title":"Vitess allows HTML injection in /debug/querylogz \u0026 /debug/env","description":"Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.","status":"published","published":"2024-12-03T15:46:40.513Z","modified":"2026-10-28T02:30:31.376870874Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"GHSA-7mwh-q3xm-qh6p","title":"Vitess allows HTML injection in /debug/querylogz \u0026 /debug/env","description":"### Summary\n\nThe `/debug/querylogz` and `/debug/env` pages for `vtgate` and `vttablet` do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will.\n\n### Details\n\nThese pages are rendered using `text/template` instead of rendering with a proper HTML templating engine.\n\n### PoC\n\nExecute any query where part of it is HTML markup, for example as part of a string. To make it easier to observe you might want to make sure the query takes a few seconds to complete, giving you time to refresh the status page. \n\nExample query that can trigger the issue:\n\n```sql\nUPDATE users\nSET\n    email = CONCAT(\"\u003cimg src=https://cataas.com/cat/says/oops\u003e\", users.idUser, \"@xxx\")\nWHERE\n    email NOT LIKE '%xxx%' AND email != \"demo@xxx.com\"\n```\n\nResult: \n\n![image](https://github.com/user-attachments/assets/c583816b-157c-474e-bbed-152b3dc0372f)\n\n### Impact\n\nAnyone looking at the Vitess status page is affected. This would normally be owners / administrators of the Vitess cluster.\n\nAnyone that can influence what text show up in queries can trigger it. This would normally be pretty much everybody interacting with a system that uses Vitess as a backend.","status":"published","published":"2024-12-03T18:43:33Z","modified":"2026-08-07T08:12:23.040509879Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"AZL-53970","title":"CVE-2024-53257 affecting package vitess for versions less than 19.0.4-7","description":"Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.","status":"published","published":"2024-12-03T16:15:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:20.828909Z"},{"id":"AZL-53977","title":"CVE-2024-53257 affecting package vitess for versions less than 17.0.7-7","description":"Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered using text/template instead of rendering with a proper HTML templating engine. This vulnerability is fixed in 21.0.1, 20.0.4, and 19.0.8.","status":"published","published":"2024-12-03T16:15:23Z","modified":"2026-04-21T04:35:26.664963Z","updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"GO-2024-3306","title":"Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess","description":"Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess","status":"published","published":"2024-12-12T22:00:01Z","modified":"2026-08-07T08:12:28.318270605Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14599-1","title":"govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20241213T205935-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-18T00:00:00Z","modified":"2026-02-04T02:20:26.243259Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}