CVE-2021-35624: MySQL Server Privilege Escalation Flaw

CVE-2021-35624 Overview

CVE-2021-35624 is a privilege-related vulnerability in the MySQL Server product of Oracle MySQL, specifically affecting the Server: Security: Privileges component. This vulnerability allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server, resulting in unauthorized creation, deletion, or modification access to critical data or all MySQL Server accessible data.

Critical Impact

A high-privileged attacker can exploit this vulnerability remotely to gain unauthorized modification access to critical MySQL Server data, potentially compromising data integrity across the entire database system.

Affected Products

• Oracle MySQL versions 5.7.35 and prior
• Oracle MySQL versions 8.0.26 and prior
• NetApp OnCommand Insight
• NetApp SnapCenter

Discovery Timeline

• 2021-10-20 - CVE-2021-35624 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-35624

Vulnerability Analysis

This vulnerability exists within the Server: Security: Privileges component of MySQL Server. The flaw enables authenticated attackers with elevated privileges to bypass intended access controls, allowing them to perform unauthorized data operations. The vulnerability is classified as easily exploitable, meaning the attack complexity is low and does not require user interaction.

The impact is primarily on data integrity rather than confidentiality or availability. An attacker who successfully exploits this vulnerability gains the ability to create, delete, or modify critical data within the MySQL Server environment. This could lead to database tampering, unauthorized schema modifications, or corruption of business-critical information.

Root Cause

The vulnerability stems from improper privilege handling within the MySQL Server's security subsystem. The Server: Security: Privileges component fails to properly enforce access control restrictions, allowing high-privileged users to exceed their intended authorization boundaries. While specific CWE classification is not available for this vulnerability, the behavior indicates a broken access control condition in the privilege management system.

Attack Vector

The attack requires network access and can be executed via multiple protocols supported by MySQL Server. The attacker must possess high-level privileges within the MySQL environment, though once this prerequisite is met, exploitation is straightforward.

The attack flow involves:

1. An attacker establishes a network connection to the vulnerable MySQL Server instance
2. The attacker authenticates with high-privileged credentials
3. The attacker leverages the privilege handling flaw to perform unauthorized data operations
4. Critical data can be created, deleted, or modified beyond the attacker's intended access level

No public proof-of-concept code is currently available for this vulnerability. For detailed technical information, refer to the Oracle Security Alert CPU October 2021.

Detection Methods for CVE-2021-35624

Indicators of Compromise

• Unexpected modifications to database schemas or critical data tables by privileged accounts
• Anomalous privilege escalation attempts or authorization bypass events in MySQL audit logs
• Unusual network connections to MySQL Server from privileged user accounts

Detection Strategies

• Enable MySQL Enterprise Audit or similar logging to capture all privilege-related operations
• Monitor for data modification operations that exceed expected authorization boundaries
• Implement database activity monitoring to detect unauthorized DDL or DML statements from privileged accounts
• Review MySQL general query logs for suspicious privilege-related commands

Monitoring Recommendations

• Configure alerting on bulk data modifications or deletions performed by administrative accounts
• Establish baseline behavior for privileged user activity and alert on deviations
• Monitor MySQL error logs for privilege-related warnings or access control failures
• Implement real-time monitoring of database integrity checksums for critical tables

How to Mitigate CVE-2021-35624

Immediate Actions Required

• Upgrade Oracle MySQL to version 5.7.36 or later for the 5.7.x branch
• Upgrade Oracle MySQL to version 8.0.27 or later for the 8.0.x branch
• Apply the October 2021 Critical Patch Update (CPU) from Oracle immediately
• Review and restrict high-privilege account access to minimize attack surface

Patch Information

Oracle has released security patches addressing this vulnerability as part of the October 2021 Critical Patch Update. Detailed patch information and download links are available in the Oracle Security Alert CPU October 2021. NetApp customers should also review the NetApp Security Advisory NTAP-20211022-0003 for guidance on affected NetApp products including OnCommand Insight and SnapCenter.

Workarounds

• Implement strict network segmentation to limit MySQL Server exposure
• Apply principle of least privilege to all MySQL accounts, reducing the number of high-privileged users
• Enable MySQL Enterprise Firewall to restrict allowed SQL statements for privileged accounts
• Use TLS/SSL encryption for all MySQL connections to prevent credential interception

# Configuration example - Restrict MySQL network access
# In my.cnf or mysql.conf.d/mysqld.cnf
[mysqld]
bind-address = 127.0.0.1
# Or restrict to specific trusted networks
# bind-address = 10.0.0.5

# Enable general query logging for audit purposes
general_log = 1
general_log_file = /var/log/mysql/mysql.log

# Require SSL for all connections
require_secure_transport = ON