title: Apache Doris MCP Server SQL Injection (CVE-2025-66335)
id: ATR-2026-00532
rule_version: 1
status: experimental
description: |
  Detects CVE-2025-66335: Apache Doris MCP server passes user-supplied SQL fragments directly to query execution without sanitisation. An attacker can inject arbitrary SQL via MCP tool call arguments to read, modify, or destroy database contents. Detection covers (a) tool call arguments containing SQL injection payloads targeting Doris MCP tool names, (b) MCP configs pointing at Doris endpoints, (c) content describing the injection surface. CWE-89 (SQL Injection).
author: ATR Community
date: 2026/05/20
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM05:2025
    - LLM06:2025
  owasp_agentic:
    - ASI05:2026
    - ASI06:2026
  mitre_atlas:
    - AML.T0049 - Exploit Public-Facing Application
  mitre_attack:
    - T1190 - Exploit Public-Facing Application
    - T1059.004 - Unix Shell
  cve:
    - CVE-2025-66335
metadata_provenance:
  mitre_atlas: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2025-66335 Apache Doris MCP server passes unsanitised SQL to query execution; Article 15 requires AI tool servers to validate and sanitise all inputs before execution.
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate SQL injection via MCP tool arguments as a critical data-integrity threat for any agent-integrated database tool.
      strength: primary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.3
      context: Runtime detection of SQL injection patterns in MCP tool arguments targeting Apache Doris is the primary risk treatment for CVE-2025-66335.
      strength: primary
    - function: Map
      subcategory: MP.5.1
      context: SQL injection via database MCP tools must be catalogued as a high-severity threat in the organizational AI risk register.
      strength: secondary
    - subcategory: GV.6.1
      function: Govern
      context: Database MCP servers (including Apache Doris) must be assessed for input validation controls before agent pipelines depend on them.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335)).
      strength: primary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must detect SQL injection payloads in MCP tool call arguments before they reach database execution.
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Apache Doris MCP Server SQL Injection (CVE-2025-66335)) as a treatment control.
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: mcp-sql-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - apache-doris
    - any
  provider:
    - any
detection:
  condition: any
  false_positives:
    - Security scanning tooling that probes Doris MCP for SQL injection vulnerabilities.
    - Educational content describing SQL injection in database MCP servers.
    - Legitimate SQL queries containing UNION or subqueries for analytics.
  conditions:
    - field: tool_response
      operator: regex
      value: (?i)"(?:query|sql|statement|command)"\s*:\s*"[^"]{0,300}(?:';\s*(?:drop|delete|insert|update|create|alter|truncate)\s+|'\s*(?:or|and)\s*'[^']{0,50}'\s*=\s*'|union\s+(?:all\s+)?select|--\s*$|/\*[^*]{0,50}\*/|xp_cmdshell|information_schema|pg_sleep|waitfor\s+delay)[^"]{0,200}"
      description: SQL injection payload in MCP tool query argument — CVE-2025-66335 Apache Doris exploitation pattern
    - field: tool_response
      operator: regex
      value: (?i)"url"\s*:\s*"https?://[^"]{0,120}(?:apache[_\-]?doris|doris[_\-]?mcp|doris\.apache)[^"]{0,60}(?:/mcp|/tools?|/api)[^"]*"(?![\s\S]{0,400}"(?:auth|headers?|token|apiKey|authorization|bearer)")
      description: MCP config pointing at Apache Doris endpoint without auth — unauthenticated SQL injection surface
    - field: content
      operator: regex
      value: (?i)(?:apache[_\-]?doris|doris[_\-]?mcp)[^\n]{0,200}(?:sql\s+injection|unsaniti[sz]ed|inject[^\n]{0,50}(?:query|sql)|cve[_\-]?2025[_\-]?66335|drop\s+table|union\s+select)
      description: Content describing or weaponising Apache Doris MCP SQL injection — CVE-2025-66335 framing
response:
  actions:
    - block_tool
    - alert
    - escalate
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-00532] CRITICAL: Apache Doris MCP SQL injection detected (CVE-2025-66335). MCP tool arguments contain SQL injection patterns targeting Apache Doris query execution. Block tool invocation immediately; patch Doris MCP server; validate and parameterise all SQL inputs.
confidence: 83