Executive brief
mysql2 is a popular MySQL database driver for Node.js applications. A vulnerability in how it handles the timezone parameter allows attackers to inject and execute arbitrary code on the server running the application. An attacker who can influence database connection parameters could gain complete control over the affected system and steal sensitive data or disrupt operations.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the mysql2 Node.js package affecting versions before 3.9.7. The readCodeFor function fails to properly sanitize the timezone parameter when constructing date/time function calls, allowing attackers to inject malicious JavaScript code. The attack requires the ability to control the timezone parameter in a database connection or query object, but does not require prior authentication or user interaction. An attacker can exploit this to execute arbitrary Node.js code with the privileges of the application process, leading to complete system compromise including code execution, data exfiltration, and denial of service. The fix was released in version 3.9.7 (April 21, 2024) via commit 7d4b098, which sanitizes the timezone parameter value before use.
Affected products
- npm mysql2 <3.9.7
Timeline
- 2024-04-21: disclosed: Vulnerability discovered by zhaoyudi (Nebulalab)
- 2024-04-21: patched: Fix released in version 3.9.7
- 2024-04-23: advisory: Public advisory published (GHSA-4rch-2fh8-94vw / CVE-2024-21511)