Executive brief
mysql2 is a popular Node.js driver for connecting to MySQL databases. A cache poisoning vulnerability in versions before 3.9.3 allows attackers to inject colon characters into cache keys, potentially causing the wrong cached query results to be returned. This could expose sensitive data or cause applications to use stale or incorrect information from the database.
Technical details
The vulnerability exists in the keyFromFields function in mysql2 before 3.9.3, where improper input validation (CWE-20) allows an attacker to inject a colon character within cache key values. By crafting specific input, an attacker can poison the query result cache, causing the application to return incorrect cached data. The attack requires network access to an application using mysql2 but no authentication or user interaction. An attacker can exploit this to retrieve sensitive information or cause the application to operate with stale data. The vulnerability is fixed in version 3.9.3 through improved cache key serialization.
Affected products
- npm mysql2 before 3.9.3
Timeline
- 2024-04-10: disclosed
- 2024-03-26: patched: Fixed in version 3.9.3 via PR #2424