CVE-2024-21511

What it actually does

The mysql2 Node.js driver before version 3.9.7 contains an arbitrary code injection flaw in handling of the connection timezone option. The vulnerable readCodeFor path builds executable parser code for MySQL date/time values and fails to safely sanitize the timezone parameter before embedding it into generated code. If an attacker can influence the timezone value used by an application when creating a MySQL connection or pool, they may cause attacker-controlled JavaScript to execute inside the Node.js process. Successful exploitation can allow full compromise of the affected application process, including access to application secrets, database credentials, data processed by the service, and the ability to execute further actions with the privileges of the running application.

Why it matters to the business

Applications that use vulnerable mysql2 versions may be exposed to full application compromise if untrusted input can reach database connection configuration. Consequences can include theft or alteration of sensitive data, unauthorized database access, service outage, credential theft, lateral movement using application secrets, and supply-chain exposure across services that depend on the affected package. Although this issue is not currently listed in CISA KEV and public exploit maturity is reported as none, the CVSS score is critical, the package is commonly used in Node.js/MySQL applications, and the vulnerability has been public since April 2024, so remediation should be treated as high priority wherever mysql2 is deployed.

How an attack unfolds

An attacker first identifies an application or integration that uses the vulnerable mysql2 driver and determines whether any externally influenced value can affect the mysql2 timezone connection option. This may occur through tenant settings, API parameters, environment-derived configuration, administrative forms, deployment variables, or other configuration paths that are not strictly validated. The attacker supplies a crafted timezone value designed to break out of the generated parser code context. When the application creates a MySQL connection and processes MySQL date/time values, mysql2 invokes its parser generation logic and embeds the malicious timezone value into executable JavaScript. The injected code then runs inside the Node.js application process. From there, the attacker may read environment variables and secrets, access database credentials already held by the application, modify application behavior, exfiltrate data, or attempt further compromise of adjacent systems reachable by the application.

How to fix it

Upgrade mysql2 to version 3.9.7 or later. For source-based deployments of sidorares/node-mysql2, ensure the code includes commit 2d3cad8a5aad37df19b6ebfcba0667a156101b06 or a later fixed revision. Regenerate lockfiles and redeploy all affected services so that no runtime image, container layer, serverless bundle, or packaged artifact continues to include a vulnerable mysql2 copy. If immediate upgrade is not possible, restrict the timezone option to a strict allowlist of known-safe values such as 'local', 'Z', or explicitly approved IANA timezone names, and ensure no user-controlled input can directly or indirectly set mysql2 connection options. Avoid dynamically constructing database connection configuration from request parameters or untrusted tenant metadata. Rotate database credentials and application secrets if exploitation is suspected.

How to confirm the fix worked

Confirm dependency resolution shows mysql2 version 3.9.7 or later in package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls output, SBOMs, and deployed artifacts. For Git-based usage, confirm the checked-out sidorares/node-mysql2 revision contains commit 2d3cad8a5aad37df19b6ebfcba0667a156101b06 or a later commit. Verify that application containers and build outputs do not include older copies under node_modules/mysql2. Review code and configuration paths to ensure the mysql2 timezone option is static or allowlisted and cannot be influenced by external users. After upgrade, run application integration tests that exercise MySQL date/time reads to ensure normal behavior and verify that crafted invalid timezone values are rejected before reaching mysql2.

Typical attack path

1. Identify a Node.js application using mysql2 before 3.9.7.
2. Find a path where the mysql2 timezone connection option can be influenced by user-controlled or externally supplied data.
3. Submit a crafted timezone value containing JavaScript injection content.
4. Trigger application behavior that opens or reuses a MySQL connection and parses MySQL date/time data.
5. Cause the vulnerable readCodeFor/parser generation path to compile and execute attacker-controlled JavaScript inside the Node.js process.
6. Use the compromised process context to access secrets, database credentials, application data, or network resources available to the service.

How to detect it

To assess prior exploitation, examine application logs, API audit logs, configuration-change logs, deployment records, and environment/configuration management systems for unexpected changes to the mysql2 timezone option or unusual timezone values. Look for timezone strings containing JavaScript syntax, quote-breaking characters, semicolons, comments, require/import usage, process access, child_process references, filesystem access, or network callback patterns. Review Node.js application logs for syntax errors, parser-generation failures, unexpected crashes, or stack traces involving mysql2 parser code around MySQL date/time reads. Inspect process execution telemetry, EDR events, and container runtime logs for Node.js spawning shells or utilities such as sh, bash, curl, wget, nc, python, or powershell, which is unusual for many database-backed application services. Review outbound network telemetry for unexpected connections from the application process shortly after configuration changes or database activity. If exploitation is suspected, preserve affected containers/hosts, collect package lockfiles and deployed node_modules contents, review secrets accessed by the process, and rotate credentials.

• node_modules/mysql2
• "mysql2": "3.9.6"
• "mysql2": "3.9.5"
• "mysql2": "3.9.4"
• "mysql2": "3.9.3"
• "mysql2": "3.9.2"
• "mysql2": "3.9.1"
• "mysql2": "3.9.0"
• "timezone"
• "child_process"
• "process.env"
• "require("
• "Function("
• "eval("
• "/bin/sh"
• "/bin/bash"
• "curl "
• "wget "
• "nc "
• "mysql2/lib/parsers"
• "readCodeFor"
• "SyntaxError"
• "Unexpected token"

What your security team should do

• Inventory all Node.js applications and build artifacts for mysql2 versions earlier than 3.9.7.
• Prioritize remediation for internet-facing services, multi-tenant applications, applications with user-configurable database settings, and services that handle sensitive data or privileged database credentials.
• Upgrade mysql2 to 3.9.7 or later and redeploy all affected runtime artifacts, including containers, serverless packages, and cached build layers.
• Add dependency-scanning policy to block mysql2 versions before 3.9.7 in new builds and pull requests.
• Review application code for any path where request data, tenant metadata, environment variables, or administrative input can set mysql2 connection options, especially timezone.
• Implement allowlist validation for database connection configuration values and reject timezone strings containing metacharacters, quotes, code-like tokens, or unexpected formats.
• Search historical logs and configuration-change records for suspicious timezone values or errors around mysql2 parser generation.
• If suspicious activity is found, rotate database credentials, application secrets, API tokens, and session-signing keys accessible to the affected Node.js process.