CVE-2021-2471: MySQL Connector/J DOS Vulnerability

CVE-2021-2471 Overview

CVE-2021-2471 is a vulnerability in the MySQL Connectors product of Oracle MySQL, specifically affecting the Connector/J component. This vulnerability affects supported versions 8.0.26 and prior, presenting a challenging attack surface that requires high privileges but can lead to significant confidentiality and availability impacts.

The vulnerability is difficult to exploit and requires a high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful exploitation can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data, as well as the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of the affected MySQL Connectors.

Critical Impact
Successful exploitation allows attackers to access critical data and cause complete denial of service in MySQL Connector/J deployments, affecting database connectivity for enterprise applications.

Affected Products

Oracle MySQL Connectors version 8.0.26 and prior
Oracle Communications Cloud Native Core Console 1.9.0
Oracle Communications Cloud Native Core Network Slice Selection Function 1.8.0
Oracle Communications Cloud Native Core Policy 1.15.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy 1.7.0
Quarkus (affected versions)

Discovery Timeline

October 20, 2021 - CVE-2021-2471 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-2471

Vulnerability Analysis

This vulnerability exists in the Connector/J component of Oracle MySQL Connectors, which is the official JDBC driver for MySQL. The Connector/J facilitates communication between Java applications and MySQL databases, making it a critical component in enterprise Java deployments that rely on MySQL as their data store.

The exploitation complexity is high, indicating that successful attacks require specific conditions or configurations to be present. Despite the difficulty in exploitation, the vulnerability has been noted as having a high probability of exploitation based on EPSS data, suggesting that despite its complexity, threat actors have demonstrated interest in targeting this vulnerability.

The impact scope is contained to the vulnerable component (unchanged scope), meaning successful exploitation does not affect resources beyond the authorization privileges of the vulnerable component. However, within that scope, both confidentiality and availability can be completely compromised.

Root Cause

The vulnerability stems from an unspecified flaw in the MySQL Connector/J component. Oracle has not disclosed detailed technical specifics about the underlying cause, classifying it under NVD-CWE-noinfo. The vulnerability allows authenticated attackers with high privileges to leverage network access through multiple protocols to compromise the MySQL Connectors, suggesting potential issues in how the connector processes certain network requests or handles authentication flows.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the vulnerable MySQL Connector/J instance. The exploitation path involves:

Network Access: The attacker must have network connectivity to the target system running the vulnerable MySQL Connector/J
High Privileges: The attacker requires elevated privileges, suggesting this may be an insider threat scenario or requires prior compromise of privileged credentials
Multiple Protocols: The vulnerability can be exploited through various network protocols supported by the connector
No User Interaction: The attack does not require any user interaction to be successful

The exploitation mechanics involve leveraging the network connectivity to send specially crafted requests that can either leak sensitive data accessible to the MySQL Connectors or cause the connector to crash repeatedly, resulting in denial of service.

Detection Methods for CVE-2021-2471

Indicators of Compromise

Unusual network traffic patterns to MySQL Connector/J instances from privileged accounts
Unexpected crashes or hangs in applications using MySQL Connector/J version 8.0.26 or earlier
Anomalous database connection attempts or authentication patterns from high-privileged contexts
Application logs showing repeated connection failures or timeout errors from the JDBC driver

Detection Strategies

Monitor application logs for MySQL Connector/J error messages indicating connection instability or unexpected terminations
Implement network monitoring to detect abnormal traffic patterns to MySQL database endpoints from Java applications
Use database activity monitoring (DAM) solutions to track privileged user activities and connection patterns
Deploy runtime application self-protection (RASP) tools to detect anomalous JDBC driver behavior

Monitoring Recommendations

Enable detailed logging for Java applications using MySQL Connector/J to capture connection lifecycle events
Configure alerts for repeated application crashes or service restarts that correlate with database connectivity issues
Monitor for unauthorized data access patterns through database audit logs
Implement SentinelOne Singularity XDR for comprehensive endpoint and workload protection to detect exploitation attempts

How to Mitigate CVE-2021-2471

Immediate Actions Required

Inventory all systems using Oracle MySQL Connector/J and identify instances running version 8.0.26 or earlier
Prioritize patching for systems handling sensitive data or critical business functions
Apply the latest Oracle Critical Patch Update to upgrade MySQL Connector/J to a patched version
Restrict network access to MySQL Connector/J instances to only necessary privileged accounts

Patch Information

Oracle has addressed this vulnerability in their Critical Patch Updates. Organizations should apply the patches available through:

Oracle Security Alert October 2021 - Initial patch release
Oracle Security Alert April 2022 - Additional updates and fixes

Organizations using the affected Oracle Communications Cloud Native Core products should upgrade to versions newer than the affected releases (Console 1.9.0, Network Slice Selection Function 1.8.0, Policy 1.15.0, and Security Edge Protection Proxy 1.7.0).

Workarounds

Implement strict network segmentation to limit access to MySQL Connector/J instances from untrusted networks
Apply principle of least privilege by reducing the number of high-privileged accounts with network access to the connector
Enable TLS/SSL for all MySQL Connector/J connections to add an additional layer of protection
Consider implementing connection pooling with monitoring to detect and isolate anomalous connection behavior

bash

# Configuration example - Verify MySQL Connector/J version in Maven projects
mvn dependency:tree | grep mysql-connector
# Update pom.xml to use patched version (8.0.27 or later)
# <dependency>
#     <groupId>mysql</groupId>
#     <artifactId>mysql-connector-java</artifactId>
#     <version>8.0.27</version>
# </dependency>