CVE-2021-2471: MySQL Connector/J DOS Vulnerability

CVE-2021-2471 Overview

CVE-2021-2471 is a vulnerability in the MySQL Connectors product of Oracle MySQL, specifically affecting the Connector/J component. This vulnerability affects supported versions 8.0.26 and prior, presenting a challenging attack surface that requires high privileges but can lead to significant confidentiality and availability impacts.

The vulnerability is difficult to exploit and requires a high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful exploitation can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data, as well as the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of the affected MySQL Connectors.

Critical Impact

Successful exploitation allows attackers to access critical data and cause complete denial of service in MySQL Connector/J deployments, affecting database connectivity for enterprise applications.

Affected Products

• Oracle MySQL Connectors version 8.0.26 and prior
• Oracle Communications Cloud Native Core Console 1.9.0
• Oracle Communications Cloud Native Core Network Slice Selection Function 1.8.0
• Oracle Communications Cloud Native Core Policy 1.15.0
• Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.7.0
• Quarkus (affected versions)

Discovery Timeline

• October 20, 2021 - CVE-2021-2471 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-2471

Vulnerability Analysis

This vulnerability exists in the Connector/J component of Oracle MySQL Connectors, which is the official JDBC driver for MySQL. The Connector/J facilitates communication between Java applications and MySQL databases, making it a critical component in enterprise Java deployments that rely on MySQL as their data store.

The exploitation complexity is high, indicating that successful attacks require specific conditions or configurations to be present. Despite the difficulty in exploitation, the vulnerability has been noted as having a high probability of exploitation based on EPSS data, suggesting that despite its complexity, threat actors have demonstrated interest in targeting this vulnerability.

The impact scope is contained to the vulnerable component (unchanged scope), meaning successful exploitation does not affect resources beyond the authorization privileges of the vulnerable component. However, within that scope, both confidentiality and availability can be completely compromised.

Root Cause

The vulnerability stems from an unspecified flaw in the MySQL Connector/J component. Oracle has not disclosed detailed technical specifics about the underlying cause, classifying it under NVD-CWE-noinfo. The vulnerability allows authenticated attackers with high privileges to leverage network access through multiple protocols to compromise the MySQL Connectors, suggesting potential issues in how the connector processes certain network requests or handles authentication flows.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the vulnerable MySQL Connector/J instance. The exploitation path involves:

1. Network Access: The attacker must have network connectivity to the target system running the vulnerable MySQL Connector/J
2. High Privileges: The attacker requires elevated privileges, suggesting this may be an insider threat scenario or requires prior compromise of privileged credentials
3. Multiple Protocols: The vulnerability can be exploited through various network protocols supported by the connector
4. No User Interaction: The attack does not require any user interaction to be successful

The exploitation mechanics involve leveraging the network connectivity to send specially crafted requests that can either leak sensitive data accessible to the MySQL Connectors or cause the connector to crash repeatedly, resulting in denial of service.

Detection Methods for CVE-2021-2471

Indicators of Compromise

• Unusual network traffic patterns to MySQL Connector/J instances from privileged accounts
• Unexpected crashes or hangs in applications using MySQL Connector/J version 8.0.26 or earlier
• Anomalous database connection attempts or authentication patterns from high-privileged contexts
• Application logs showing repeated connection failures or timeout errors from the JDBC driver

Detection Strategies

• Monitor application logs for MySQL Connector/J error messages indicating connection instability or unexpected terminations
• Implement network monitoring to detect abnormal traffic patterns to MySQL database endpoints from Java applications
• Use database activity monitoring (DAM) solutions to track privileged user activities and connection patterns
• Deploy runtime application self-protection (RASP) tools to detect anomalous JDBC driver behavior

Monitoring Recommendations

• Enable detailed logging for Java applications using MySQL Connector/J to capture connection lifecycle events
• Configure alerts for repeated application crashes or service restarts that correlate with database connectivity issues
• Monitor for unauthorized data access patterns through database audit logs
• Implement SentinelOne Singularity XDR for comprehensive endpoint and workload protection to detect exploitation attempts

How to Mitigate CVE-2021-2471

Immediate Actions Required

• Inventory all systems using Oracle MySQL Connector/J and identify instances running version 8.0.26 or earlier
• Prioritize patching for systems handling sensitive data or critical business functions
• Apply the latest Oracle Critical Patch Update to upgrade MySQL Connector/J to a patched version
• Restrict network access to MySQL Connector/J instances to only necessary privileged accounts

Patch Information

Oracle has addressed this vulnerability in their Critical Patch Updates. Organizations should apply the patches available through:

• Oracle Security Alert October 2021 - Initial patch release
• Oracle Security Alert April 2022 - Additional updates and fixes

Organizations using the affected Oracle Communications Cloud Native Core products should upgrade to versions newer than the affected releases (Console 1.9.0, Network Slice Selection Function 1.8.0, Policy 1.15.0, and Security Edge Protection Proxy 1.7.0).

Workarounds

• Implement strict network segmentation to limit access to MySQL Connector/J instances from untrusted networks
• Apply principle of least privilege by reducing the number of high-privileged accounts with network access to the connector
• Enable TLS/SSL for all MySQL Connector/J connections to add an additional layer of protection
• Consider implementing connection pooling with monitoring to detect and isolate anomalous connection behavior

# Configuration example - Verify MySQL Connector/J version in Maven projects
mvn dependency:tree | grep mysql-connector
# Update pom.xml to use patched version (8.0.27 or later)
# <dependency>
#     <groupId>mysql</groupId>
#     <artifactId>mysql-connector-java</artifactId>
#     <version>8.0.27</version>
# </dependency>