CVE-2021-35598

What it actually does

CVE-2021-35598 is an improper input validation vulnerability in Oracle MySQL Cluster, specifically the Cluster: General component. A high-privileged attacker who can access the adjacent physical communication segment used by the MySQL Cluster can, with required user interaction from another person, trigger conditions that may lead to full compromise of the MySQL Cluster. Successful exploitation can affect confidentiality, integrity, and availability, up to takeover of the clustered database service.

Why it matters to the business

A successful attack could allow an attacker to take control of a MySQL Cluster environment, exposing sensitive data, enabling unauthorized data modification, and disrupting applications that depend on the database cluster. Exploitation is constrained because it requires high privileges, adjacent network or physical-segment access, high attack complexity, and user interaction; however, the EPSS value is elevated enough to justify attention, especially where MySQL Cluster supports critical services or is embedded in downstream products such as NetApp OnCommand Insight or NetApp SnapCenter.

How an attack unfolds

An attacker first needs privileged access and network adjacency to the communication segment used by MySQL Cluster nodes. From that position, the attacker crafts or manipulates inputs handled by the MySQL Cluster general cluster component. Because exploitation requires user interaction, the attacker must induce an authorized user or administrator to perform an action that causes the vulnerable component to process the malicious input or state. If the validation flaw is successfully triggered, the attacker may be able to compromise the cluster control plane or data path and progress to takeover of the MySQL Cluster, with potential read, write, and service-disruption capability. No public exploit maturity or KEV listing is indicated, so exploitation should be treated as plausible but not confirmed as broadly weaponized from the provided data.

How to fix it

Upgrade Oracle MySQL Cluster to a vendor-supported version newer than the affected release lines: later than 7.4.33, later than 7.5.23, later than 7.6.19, or later than 8.0.26, following Oracle Critical Patch Update guidance for the applicable branch. Where MySQL Cluster is included in dependent products, apply vendor updates or advisories from the affected product vendor, including NetApp OnCommand Insight and NetApp SnapCenter where applicable. Restrict MySQL Cluster inter-node and management communication to dedicated, trusted network segments; prevent untrusted systems from reaching the physical or adjacent communication segment; limit administrative access; and require change-control review for cluster-management actions until patched. If immediate patching is not possible, reduce exposure by isolating cluster networks, enforcing least privilege, monitoring cluster administration activity, and disabling unnecessary management access paths.

How to confirm the fix worked

Confirm installed MySQL Cluster versions are no longer in the affected ranges: 7.4.33 and earlier, 7.5.23 and earlier, 7.6.19 and earlier, or 8.0.26 and earlier. Use vendor package inventory, MySQL Cluster management tooling, and application dependency inventories to verify both standalone and bundled deployments. Validate that NetApp OnCommand Insight and NetApp SnapCenter deployments, if present, have received the vendor-recommended updates. Review network controls to ensure only approved cluster nodes and administrative hosts can communicate over MySQL Cluster inter-node and management channels. After patching, perform a controlled service restart or rolling upgrade validation consistent with MySQL Cluster operational procedures, then verify cluster health, node membership, replication/data-node status, and application connectivity.

Typical attack path

1. Gain high-privileged access relevant to the MySQL Cluster environment or its management path.
2. Obtain access to the adjacent physical or local communication segment used by MySQL Cluster nodes.
3. Identify affected MySQL Cluster versions: 7.4.33 or earlier, 7.5.23 or earlier, 7.6.19 or earlier, or 8.0.26 or earlier.
4. Prepare malformed or unexpected input targeting the Cluster: General component’s validation weakness.
5. Cause a separate authorized user to interact with the affected workflow or data path required to trigger the vulnerability.
6. Exploit the validation failure to compromise the cluster.
7. Use the compromised cluster to access data, alter database contents, disrupt availability, or maintain control.

How to detect it

Look for signs of suspicious activity around MySQL Cluster administration, inter-node communication, and maintenance workflows. Relevant log sources include MySQL Cluster management server logs, data node logs, SQL/API node logs, operating system authentication logs, privileged command history, network firewall or segmentation logs, NetFlow/packet metadata for cluster communication networks, and downstream product logs for NetApp OnCommand Insight or NetApp SnapCenter where they embed or manage affected components. Investigate unexpected cluster node joins or removals, configuration changes, forced restarts, unexplained failovers, abnormal management commands, crashes in cluster processes, or administrative actions shortly after unusual emails, tickets, chat requests, or other prompts to an operator. Because no specific public exploit artifact is provided, detection should focus on behavioral indicators: high-privilege access from unusual hosts, traffic from non-cluster systems on MySQL Cluster communication segments, malformed or rejected cluster messages if logged, and cluster instability correlated with privileged user interaction.

• ndb_mgmd
• ndbd
• ndbmtd
• mysqld
• ndb_mgm
• Cluster: General
• Node failure
• Node restart
• Node shutdown
• Node started
• Node connected
• Node disconnected
• Config change
• Configuration changed
• Arbitrator
• TransporterRegistry
• Signal error
• Invalid signal
• Invalid message
• Unexpected signal
• NDB
• MySQL Cluster

What your security team should do

• Prioritize patching MySQL Cluster instances that support business-critical applications, contain sensitive data, or are reachable from shared administrative or data-center network segments.
• Inventory all direct and bundled uses of MySQL Cluster, including Oracle MySQL Cluster, NetApp OnCommand Insight, and NetApp SnapCenter deployments.
• Restrict access to MySQL Cluster inter-node and management networks to known cluster members and approved administrative systems only.
• Review privileged accounts with access to MySQL Cluster management functions and remove unnecessary access.
• Monitor for unusual cluster-management actions, unexpected node membership changes, unexplained service restarts, and anomalous traffic on cluster communication segments.
• Because exploitation requires user interaction, reinforce administrative change-control procedures and scrutinize unexpected requests involving cluster configuration, imports, maintenance actions, or troubleshooting steps.
• Track Oracle and downstream vendor advisories for exact fixed releases applicable to the deployed product branch.