Quick answers
- Is CVE-2024-21512 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-21512 being exploited in the wild.
- How severe is CVE-2024-21512?
- Low severity, with a CVSS score of 3.1, published 30 May 2024.
- Which products and versions are affected?
- mysql2 (npm) SEMVER:introduced=0,fixed=3.9.8.
- Is there a fix for CVE-2024-21512?
- Yes. mysql2 (npm): upgrade to 3.9.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-21512 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2024-21512?
- Check whether you run mysql2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mysql2 (npm): upgrade to 3.9.8 or later
npm install mysql2@3.9.8
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in mysql2 versions before 3.9.8. The root cause is improper sanitization of user input passed to the fields and tables parameters when using the nestTables feature. An attacker who can control database query results can inject malicious field or table names that pollute the prototype chain of JavaScript objects. This requires network access to the database or the ability to influence query results; no authentication bypass is required beyond normal database access. Prototype pollution can lead to unexpected application behavior, information disclosure, or integrity violations. The fix was released in version 3.9.8 with proper input sanitization (PR #2702).
Affected products
- mysql2 mysql2 before 3.9.8
Identifiers
- CVE-2024-21512
- GHSA-pmh2-wpjm-fj45
Timeline
- 2024-05-30: disclosed
- 2024-05-26: patched: Fixed in version 3.9.8