CVE-2024-21508: mysql2 remote code execution in readCodeFor function

CVE-2024-21508 · Severity: low · CVSS 3.1 · Published 2024-04-11

mysql2 is a Node.js library used to connect applications to MySQL databases. The library improperly validates configuration parameters related to big number handling, allowing an attacker to execute arbitrary code on systems using affected versions. An attacker can exploit this vulnerability through connection parameters sent to vulnerable instances, potentially gaining full control of the application and its underlying system.

Technologies: mysql2 (npm). Vendors: npm.

Quick answers

Is CVE-2024-21508 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-21508 being exploited in the wild.
How severe is CVE-2024-21508?
Low severity, with a CVSS score of 3.1, published 11 April 2024.
Which products and versions are affected?
mysql2 (npm) SEMVER:introduced=0,fixed=3.9.4.
Is there a fix for CVE-2024-21508?
Yes. mysql2 (npm): upgrade to 3.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-21508 attacked?
It is attacked over the network.
Am I affected by CVE-2024-21508?
Check whether you run mysql2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mysql2 (npm): upgrade to 3.9.4 or later
    npm install mysql2@3.9.4

Technical details

The vulnerability exists in the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings configuration values. This is a code injection vulnerability (CWE-94) where unsanitized user input in connection configuration parameters can be evaluated as code. The attack requires network access to a system running a vulnerable mysql2 version and the ability to provide crafted configuration parameters—no authentication is required. An attacker can achieve remote code execution with the privileges of the Node.js process. The vulnerability was patched in version 3.9.4 with improved sanitization of big number configuration parameters.

Affected products

  • mysql2 mysql2 before 3.9.4

Identifiers

  • CVE-2024-21508
  • GHSA-fpw7-j2hg-69v5

Timeline

  • 2024-04-11: disclosed: CVE-2024-21508 and GHSA-fpw7-j2hg-69v5 published
  • 2024-04-09: patched: Fix merged in PR #2572; version 3.9.4 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.