SQLi

CVE-2025-27018: SQL Injection Vulnerability in Apache Airflow MySQL Provider

David Wilson

David Wilson

— 5 min read

Executive Summary

CVE-2025-27018 is a critical SQL Injection vulnerability affecting Apache Airflow MySQL Provider versions prior to 6.2.0. This vulnerability arises from the improper neutralization of special elements within SQL commands used by the dump_sql and load_sql functions. An attacker could exploit this flaw by injecting malicious SQL code through the table parameter, potentially leading to data corruption, modification, or unauthorized data access. Users are strongly advised to upgrade to version 6.2.0 to mitigate this risk.

Technical Details

The vulnerability resides within the providers/mysql/src/airflow/providers/mysql/hooks/mysql.py file of the Apache Airflow MySQL Provider. Specifically, the bulk_load and bulk_dump functions are susceptible to SQL injection.

Affected Systems:

  • Apache Airflow using the MySQL Provider.

Affected Software Versions:

  • Apache Airflow MySQL Provider versions prior to 6.2.0.

Affected Components:

  • bulk_load function in providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
  • bulk_dump function in providers/mysql/src/airflow/providers/mysql/hooks/mysql.py

The core issue stems from the direct inclusion of the user-supplied table parameter into the SQL query without proper sanitization or validation. This allows an attacker to craft a malicious table name that includes SQL commands, which will then be executed by the MySQL server.

Root Cause Analysis

The root cause of CVE-2025-27018 is the lack of input validation on the table parameter passed to the bulk_load and bulk_dump functions. These functions construct SQL queries using string concatenation, directly embedding the table parameter into the query. This allows an attacker to inject arbitrary SQL code by manipulating the table parameter.

Here's a simplified example of the vulnerable code:

def bulk_load(self, table: str, tmp_file: str) -> None:
    conn = self.get_conn()
    cur = conn.cursor()
    query = f"LOAD DATA LOCAL INFILE %s INTO TABLE {table}" # Vulnerable line
    cur.execute(query, (tmp_file,))

In this example, if the table parameter is set to something like "users; DROP TABLE users;", the resulting query would be:

LOAD DATA LOCAL INFILE %s INTO TABLE users; DROP TABLE users;

This would first attempt to load data into the users table (if it exists), and then execute the DROP TABLE users; command, potentially causing significant data loss.

Similarly, the bulk_dump function is vulnerable:

def bulk_dump(self, table: str, tmp_file: str) -> None:
    conn = self.get_conn()
    cur = conn.cursor()
    query = f"SELECT * INTO OUTFILE %s FROM {table}" # Vulnerable line
    cur.execute(query, (tmp_file,))

An attacker could inject SQL code into the table parameter to modify data during the dump process or execute other malicious commands.

Patch Analysis

The fix for CVE-2025-27018 involves adding regular expression validation to the table parameter in both the bulk_load and bulk_dump functions. This validation ensures that the table parameter only contains alphanumeric characters, underscores, and periods, preventing the injection of arbitrary SQL code.

Here's the patch applied to the bulk_load function:

--- a/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
+++ b/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
@@ -240,8 +240,14 @@ def get_conn(self) -> MySQLConnectionTypes:
 
     def bulk_load(self, table: str, tmp_file: str) -> None:
         """Load a tab-delimited file into a database table."""
+        import re
+
         conn = self.get_conn()
         cur = conn.cursor()
+
+        if not re.fullmatch(r"^[a-zA-Z0-9_.]+$", table):
+            raise ValueError(f"Invalid table name: {table}")
+
         cur.execute(
             f"LOAD DATA LOCAL INFILE %s INTO TABLE {table}",
             (tmp_file,),

Explanation:

  1. import re: This line imports the re module, which provides regular expression operations.
  2. if not re.fullmatch(r"^[a-zA-Z0-9_.]+$", table):: This line performs the regular expression validation.
    • re.fullmatch() attempts to match the entire string against the pattern.
    • r"^[a-zA-Z0-9_.]+$" is the regular expression pattern.
      • ^ matches the beginning of the string.
      • [a-zA-Z0-9_.] matches any alphanumeric character, underscore, or period.
      • + matches one or more occurrences of the preceding character set.
      • $ matches the end of the string.
    • If the table parameter does not match this pattern, a ValueError is raised, preventing the execution of the SQL query.
  3. The cur.execute line remains, but now it's protected by the regex validation.

Here's the patch applied to the bulk_dump function:

--- a/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
+++ b/providers/mysql/src/airflow/providers/mysql/hooks/mysql.py
@@ -251,8 +251,14 @@ def bulk_load(self, table: str, tmp_file: str) -> None:
 
     def bulk_dump(self, table: str, tmp_file: str) -> None:
         """Dump a database table into a tab-delimited file."""
+        import re
+
         conn = self.get_conn()
         cur = conn.cursor()
+
+        if not re.fullmatch(r"^[a-zA-Z0-9_.]+$", table):\
+            raise ValueError(f"Invalid table name: {table}")
+
         cur.execute(
             f"SELECT * INTO OUTFILE %s FROM {table}",
             (tmp_file,),\

The patch for bulk_dump is identical in structure and function to the patch for bulk_load, ensuring that the table parameter is validated before being used in the SQL query.

Exploitation Techniques

An attacker can exploit this vulnerability by crafting a malicious table parameter that contains SQL injection payloads. This can be achieved through the Airflow UI or API when triggering a DAG that uses the vulnerable bulk_load or bulk_dump functions.

Attack Scenario:

  1. The attacker identifies an Airflow DAG that uses the bulk_load or bulk_dump functions with a user-controlled table parameter.
  2. The attacker crafts a malicious table parameter containing SQL injection code.
  3. The attacker triggers the DAG with the malicious table parameter.
  4. The vulnerable function executes the injected SQL code, potentially leading to data corruption, modification, or unauthorized data access.

Proof-of-Concept (PoC) Example:

Let's assume an Airflow DAG uses the bulk_load function and allows users to specify the table parameter via a configuration option. An attacker could set the table parameter to:

users; DROP TABLE users; --

When the bulk_load function is executed, the resulting SQL query would be:

LOAD DATA LOCAL INFILE %s INTO TABLE users; DROP TABLE users; --

This would first attempt to load data into the users table (if it exists), and then execute the DROP TABLE users; command, deleting the users table. The -- is a MySQL comment, which would comment out any characters after the injected SQL.

Another PoC Example:

An attacker could use a table parameter like this to exfiltrate data:

users; SELECT * FROM sensitive_data INTO OUTFILE '/tmp/exfiltrated_data.txt'; --

This would dump the contents of the sensitive_data table into a file on the MySQL server, which the attacker might be able to access through other vulnerabilities or misconfigurations.

Real-World Impacts:

  • Data Loss: Attackers could drop tables, leading to significant data loss.
  • Data Corruption: Attackers could modify data within tables, leading to data integrity issues.
  • Data Exfiltration: Attackers could extract sensitive data from the database.
  • Privilege Escalation: In some cases, attackers might be able to escalate their privileges within the database server.
  • Denial of Service: Attackers could execute resource-intensive queries to overload the database server.

Mitigation Strategies

To mitigate the risk of CVE-2025-27018, the following strategies are recommended:

  1. Upgrade to Version 6.2.0: The most effective mitigation is to upgrade to Apache Airflow MySQL Provider version 6.2.0 or later, which includes the fix for this vulnerability.
  2. Input Validation: Implement robust input validation on all user-supplied parameters, especially those used in SQL queries. Use parameterized queries or prepared statements to prevent SQL injection.
  3. Principle of Least Privilege: Grant database users only the minimum necessary privileges. Avoid using highly privileged accounts for routine operations.
  4. Web Application Firewall (WAF): Deploy a WAF to detect and block SQL injection attempts. Configure the WAF with rules that specifically target SQL injection payloads.
  5. Regular Security Audits: Conduct regular security audits of Airflow deployments to identify and address potential vulnerabilities.
  6. Monitor Database Activity: Monitor database activity for suspicious queries or unusual behavior. Set up alerts for potential SQL injection attacks.
  7. Disable LOAD DATA LOCAL INFILE: If possible, disable the LOAD DATA LOCAL INFILE functionality on the MySQL server, as it can be a source of security vulnerabilities. This can be done by setting local_infile=0 in the MySQL configuration file.

Timeline of Discovery and Disclosure

  • 2025-03-01: Vulnerability reported to the Apache Airflow security team.
  • 2025-03-01: Patches developed and submitted via pull requests.
  • 2025-03-19: CVE-2025-27018 assigned.
  • 2025-03-19: Apache Airflow MySQL Provider version 6.2.0 released with the fix.
  • 2025-03-19: Public disclosure of CVE-2025-27018.

References

Read more