CVE-2025-66336: Apache Doris — SQL Injection Enables Data Breach (June 2024)

CVE-2025-66336 — Apache Doris

CVE-2025-66336 is a high-severity vulnerability in Apache Doris that exposes installations to SQL injection attacks. Exploitation enables attackers to execute arbitrary SQL commands, potentially resulting in unauthorized data access or manipulation. There is no confirmation of active exploitation at this time, but the risk to data integrity and confidentiality is significant.

Attack Vector

Attackers exploit this flaw by submitting crafted SQL queries to vulnerable Doris endpoints. If input validation is insufficient, malicious SQL statements can be executed with the privileges of the Doris process. This enables reading, modifying, or deleting database contents. No authentication bypass is required; exploitation depends on the ability to send SQL queries to Doris, either via exposed APIs or compromised application layers.

Who Is at Risk

All organizations running Apache Doris are at risk, especially those with internet-exposed Doris deployments or weak access controls. The vulnerability affects all unpatched versions of Apache Doris. Enterprises using Doris for analytics or data warehousing should prioritize assessment and remediation.

Patch & Mitigate

• Patch: Apply the latest security update for Apache Doris immediately. Check the official project repository for fixed versions and release notes.
• Workaround: Restrict network access to Doris instances and enforce strict input validation at the application layer until patching is complete.
• Detect: Review Doris logs for anomalous or suspicious SQL queries, especially those containing unexpected concatenation or control characters. Monitor for unauthorized data access or modification events.

MITRE ATT&CK

• TA0005 — Defense Evasion: Attackers use SQL injection to bypass application logic and security controls.
• T1190 — Exploit Public-Facing Application: The vulnerability is exploited via exposed Doris endpoints.

Source: https://securityonline.info/apache-doris-sql-injection-cve-2025-66336