Executive Summary

ProxySQL's GenAI/MCP `run_sql_readonly` tool is intended to allow only read-only SQL queries to MySQL targets. However, in versions 3.0.0 through 3.0.8, it fails to enforce this properly because it validates the entire input string using a substring blacklist and a first-keyword allowlist but then executes the entire SQL string on a backend connection that supports multiple statements.

This means an attacker can submit a query starting with a read-only statement like `SELECT 1;` followed by a side-effecting statement such as `RENAME TABLE ...`. The validator accepts the input because it only checks the first keyword and misses many side-effecting commands in the blacklist.

As a result, the tool violates its read-only contract by allowing backend writes or administrative SQL commands to be executed, limited only by the database privileges of the configured MCP target account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to bypass the read-only restrictions of ProxySQL's GenAI/MCP run_sql_readonly tool and execute side-effecting SQL statements such as renaming tables or modifying database state. This can lead to unauthorized data modification or administrative actions within the database.

Such unauthorized modifications can compromise data integrity and potentially lead to breaches of data protection regulations like GDPR or HIPAA, which require strict controls over data access and modification to protect personal and sensitive information.

If exploited, this vulnerability could result in non-compliance with these standards due to unauthorized changes to data or schema, risking data integrity, confidentiality, and auditability.

Mitigations such as disabling MCP unless required, enforcing authentication tokens, restricting network exposure, and using read-only database credentials help reduce the risk and support compliance efforts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to serious impacts including unauthorized modification of database schema or data, operational disruption, and compromise of backend database integrity.

An attacker exploiting this flaw can perform backend writes or administrative SQL commands through the read-only interface, potentially renaming tables, changing settings, locking tables, or killing connections.

The extent of the impact depends on the privileges of the MCP target account configured in ProxySQL, but it can result in high integrity impact without requiring any prior privileges or user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for multi-statement SQL queries sent to the /mcp/query endpoint, especially those that start with a read-only statement like SELECT followed by side-effecting statements such as RENAME TABLE, SET, RESET, LOCK TABLES, or KILL.

Detection can involve checking logs or network traffic for suspicious multi-statement payloads that bypass the read-only validation.

Since the vulnerability involves multi-statement queries executed via CLIENT_MULTI_STATEMENTS, commands or scripts that parse SQL queries to identify semicolons outside of string literals or comments can help detect exploitation attempts.

Specific commands are not provided in the resources, but one could use network packet inspection tools (e.g., tcpdump, Wireshark) to capture traffic to the /mcp/query endpoint and search for SQL queries containing semicolons indicating multi-statements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Disable the MCP (Management Control Protocol) unless it is strictly required.
• Set a non-empty authentication token for the mcp-query_endpoint_auth configuration before exposing the /mcp/query endpoint.
• Restrict network exposure of the MCP listener to trusted hosts only.
• Configure MCP backend target credentials as database-level read-only users to limit the impact of any exploit.
• Add temporary MCP query rules to block obvious multi-statement patterns, such as queries containing semicolons.

Useful 0 Not Useful 0