TiDB 8.5.2 Security Assessment Unauthenticated Internal APIs...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://nccgroup.com/research/public-report-tidb-security-assessment
• Blog Title: TiDB 8.5.2 Security Assessment: Unauthenticated Internal APIs, Plaintext Cluster Traffic, and Dependency Risks
• Suggested Section: Network Services Pentesting → new 'Pentesting TiDB' page, with cross-references to the Web/Golang material for exposed pprof and HTTP management endpoints. The page should focus on listener enumeration, Prometheus and TiDB status/configuration API exposure, unauthenticated administrative routes, and plaintext TiDB component communication, while omitting generic dependency findings unless they are tied to an exploitable call path.

🎯 Content Summary

Scope and methodology. In the summer and fall of 2025, PingCAP engaged NCC Group to perform a code-assisted security assessment of the cloud-native distributed SQL database TiDB 8.5.2. The assessment ran from June 25, 2025 through September 4, 2025 and combined white-box source-code review, static analysis, targeted manual review, and dynamic testing of a dedicated deployment. One consultant performed 45 person-days of testing against Go and Rust components. The assessment identified e...

🔧 Technical Details

Discover and abuse network-exposed management interfaces. When a distributed database binds monitoring, status, configuration, or administrative HTTP services to 0.0.0.0 or * without authentication and TLS, an attacker who reaches the internal network can first enumerate listeners with netstat -tlnp, identify service ports and owning processes, and then issue unauthenticated HTTP requests. Prometheus on port 9090, TiDB status interfaces on port 10080, and related monitoring services can expose information or allow service-state operations without database credentials. The technique depends on network access and is primarily a post-compromise or internal-network attack.

Use exposed Go pprof endpoints for runtime reconnaissance. An unauthenticated /debug/pprof/ interface can be queried to obtain profiling data, goroutine stacks, function information, object memory addres...

🤖 Agent Actions

Plan:

1. Map the network-service documentation and search for existing TiDB, pprof, Prometheus, and plaintext-cluster coverage.
2. Read at least five candidate pages plus navigation files, then choose the narrowest non-duplicative location.
3. Verify the primary report and official TiDB endpoint/TLS details.
4. Implement one concise, cited update, wire navigation/cross-references, and validate links, formatting, and the diff.
   Repository review shows no TiDB page. The closest pages cover single database protocols, while this assessment concerns a multi-listener database cluster and its management plane, so a dedicated network-services page is the least duplicative fit. I’ll use the report as the primary source and official PingCAP docs only to verify ports, routes, and TLS behavior.
   Research confirms the useful delta: TiDB’s SQL listener is only one part of the attack surface. The TiDB status listener exposes self-documenting HTTP routes and pprof; PD’s client/API port includes both read-only topology endpoints and state-changing routes; TLS/mTLS changes the security boundary across these listeners. I’ll omit dependency inventories and unproven RCE claims.
   Implementation is complete. I added the TiKV status plane as a distinct section because the audited Rust server exposes its own read-only and mutating routes on 20180; this avoids incorrectly treating every /debug/pprof/* path as Go-specific. I’m doing the final consistency and diff checks now.
   Implemented the TiDB documentation update.

Changes

• Added src/network-services-pentesting/4000-10080-pentesting-tidb.md
  • Listener and transport enumeration
  • TiDB, PD, and TiKV status/control APIs
  • Go and TiKV profiling endpoints
  • Prometheus reconnaissance
  • Plaintext component traffic validation
  • TLS/mTLS and hardening checks
  • Numbered citations to primary research, source code, and official documentation
• Added the page to src/SUMMARY.md.
• Added a cross-reference from pentesting-web/golang.md.

Validation

• git diff --check passed.
• Internal links and reference numbering validated.
• All external references returned HTTP 200.
• Forbidden sources are absent.
• mdbook and markdownlint were not installed, so those checks could not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://nccgroup.com/research/public-report-tidb-security-assessment

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting → new 'Pentesting TiDB' page, with cross-references to the Web/Golang material for exposed pprof and HTTP management endpoints. The page should focus on listener enumeration, Prometheus and TiDB status/configuration API exposure, unauthenticated administrative routes, and plaintext TiDB component communication, while omitting generic dependency findings unless they are tied to an exploitable call path.".

Repository Maintenance:

• MD Files Formatting: 1033 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0