CVE-2024-21508

What it actually does

A vulnerability in the `mysql2` Node.js package allows for Remote Code Execution (RCE). The flaw exists in the `readCodeFor` function, which improperly validates the `supportBigNumbers` and `bigNumberStrings` configuration options when parsing responses from a MySQL server. An attacker controlling the database server (or performing a Man-in-the-Middle attack) can send a specially crafted response that, when processed by the vulnerable library, triggers arbitrary code execution on the application server with the privileges of the Node.js process.

Why it matters to the business

This vulnerability is critical, with a CVSS score of 9.8, and could lead to a full compromise of the application server. An attacker could steal sensitive data processed by the application, including customer information and intellectual property, disrupt services leading to downtime, or use the compromised server as a foothold to launch further attacks against the internal network. A successful exploit can result in significant financial loss, reputational damage, and regulatory penalties.

How an attack unfolds

An attacker must first gain control of the MySQL database server an application connects to, or position themselves as a Man-in-the-Middle (MITM) to intercept the database connection. When the Node.js application, using a vulnerable version of the `mysql2` library, connects and sends a query, the attacker's malicious server responds with a specially crafted data packet. This packet is designed to exploit the improper validation logic for handling large numbers. The vulnerable `mysql2` library mishandles this response, leading to the execution of code supplied by the attacker on the application server, resulting in a complete takeover.

How to fix it

To remediate this vulnerability, upgrade the `mysql2` package to version 3.9.4 or later. You can perform the upgrade using your package manager, for example, by running `npm install mysql2@latest` or `yarn upgrade mysql2 --latest`. After upgrading, verify that the lock file (`package-lock.json` or `yarn.lock`) reflects the updated, non-vulnerable version.

How to confirm the fix worked

To validate the fix, check the installed version of the `mysql2` package in your project's dependencies. Run `npm list mysql2` or `yarn list --pattern mysql2` in your project directory to confirm that the resolved version is 3.9.4 or higher. Additionally, utilize a Software Composition Analysis (SCA) tool to scan your application's dependencies for any remaining instances of the vulnerable package.

Typical attack path

1. An attacker compromises a MySQL database server or establishes a Man-in-the-Middle position between an application and its database.
2. A Node.js application using a vulnerable version of the `mysql2` library connects to the attacker-controlled database.
3. The attacker's database sends a malicious, specially crafted response to a query from the application.
4. The `mysql2` library on the application server fails to properly validate the response, triggering a code execution vulnerability.
5. The attacker's payload is executed on the application server, granting them full control.

How to detect it

Detecting past exploitation requires looking for post-compromise activity on the application server. The exploit itself occurs within the encrypted or internal network traffic between the application and the database. Security teams should review host-based logs on application servers for anomalous behavior originating from the Node.js process, such as the spawning of shells (e.g., sh, bash, powershell), execution of unexpected commands, or establishment of network connections to unknown external IP addresses. Also, investigate application logs for unexpected restarts or crashes that could correlate with exploit attempts.

What your security team should do

• Immediately identify all Node.js applications using the `mysql2` library and prioritize upgrading them to version 3.9.4 or later due to the critical risk of RCE.
• Ensure all database connections are configured to use TLS/SSL to prevent Man-in-the-Middle attacks, a key vector for this vulnerability.
• If patching is delayed, implement strict network egress rules on application servers to only allow connections to known, trusted database hosts, limiting the attack surface.
• Review server and application logs for signs of compromise, such as unexpected process executions, outbound network connections, or application crashes.