Executive brief
mysql2 is a Node.js library used to connect applications to MySQL databases. The library improperly validates configuration parameters related to big number handling, allowing an attacker to execute arbitrary code on systems using affected versions. An attacker can exploit this vulnerability through connection parameters sent to vulnerable instances, potentially gaining full control of the application and its underlying system.
Technical details
The vulnerability exists in the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings configuration values. This is a code injection vulnerability (CWE-94) where unsanitized user input in connection configuration parameters can be evaluated as code. The attack requires network access to a system running a vulnerable mysql2 version and the ability to provide crafted configuration parameters—no authentication is required. An attacker can achieve remote code execution with the privileges of the Node.js process. The vulnerability was patched in version 3.9.4 with improved sanitization of big number configuration parameters.
Affected products
- mysql2 mysql2 before 3.9.4
Timeline
- 2024-04-11: disclosed: CVE-2024-21508 and GHSA-fpw7-j2hg-69v5 published
- 2024-04-09: patched: Fix merged in PR #2572; version 3.9.4 released