Executive brief
mysql2 is a popular Node.js MySQL database client library. Due to improper sanitization of user input, the library is vulnerable to prototype pollution when using the nestTables feature, which could allow attackers to modify application behavior and integrity by polluting the JavaScript object prototype chain.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in mysql2 versions before 3.9.8. The root cause is improper sanitization of user input passed to the fields and tables parameters when using the nestTables feature. An attacker who can control database query results can inject malicious field or table names that pollute the prototype chain of JavaScript objects. This requires network access to the database or the ability to influence query results; no authentication bypass is required beyond normal database access. Prototype pollution can lead to unexpected application behavior, information disclosure, or integrity violations. The fix was released in version 3.9.8 with proper input sanitization (PR #2702).
Affected products
- mysql2 mysql2 before 3.9.8
Timeline
- 2024-05-30: disclosed
- 2024-05-26: patched: Fixed in version 3.9.8