CVE-2022-21363: MySQL Connector/J Privilege Escalation

CVE-2022-21363 Overview

CVE-2022-21363 is a vulnerability in the MySQL Connectors product of Oracle MySQL, specifically affecting the Connector/J component. This vulnerability allows a high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is difficult to exploit due to its high attack complexity, successful exploitation can result in a complete takeover of MySQL Connectors, impacting confidentiality, integrity, and availability.

Critical Impact

Successful exploitation can result in complete takeover of MySQL Connectors, allowing attackers with high privileges to gain full control over the affected component with potential impacts to data confidentiality, integrity, and system availability.

Affected Products

• Oracle MySQL Connectors version 8.0.27 and prior
• Quarkus (various versions affected)
• Applications utilizing MySQL Connector/J for database connectivity

Discovery Timeline

• January 19, 2022 - CVE-2022-21363 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-21363

Vulnerability Analysis

This vulnerability affects the Connector/J component within Oracle's MySQL Connectors product. The vulnerability requires an attacker to have high privileges and network access to exploit it. Despite the difficulty in exploitation due to high attack complexity requirements, successful attacks can lead to a complete compromise of MySQL Connectors.

The vulnerability impacts all three security pillars: confidentiality, integrity, and availability. An attacker who successfully exploits this vulnerability could potentially intercept or modify database communications, manipulate data in transit, or disrupt database connectivity for applications relying on the affected connector.

Root Cause

The specific root cause has not been disclosed by Oracle in their security advisory. The vulnerability is classified as NVD-CWE-noinfo, indicating that detailed technical information about the weakness type has not been publicly released. This classification is common for Oracle vulnerabilities where specific technical details are kept confidential to prevent exploitation.

Attack Vector

The attack vector is network-based, meaning an attacker must have network access to the vulnerable component to exploit this vulnerability. The exploitation requires:

• High Privileges: The attacker must possess elevated privileges to initiate the attack
• Network Access: The attacker needs network connectivity via multiple protocols
• No User Interaction: The attack can be performed without requiring any user interaction
• High Complexity: Conditions beyond the attacker's control must exist for successful exploitation

The vulnerability does not change the scope, meaning the vulnerable component and impacted component remain the same (MySQL Connectors).

Detection Methods for CVE-2022-21363

Indicators of Compromise

• Unexpected network connections to MySQL Connector/J services from privileged accounts
• Anomalous database connection patterns or authentication attempts from high-privilege contexts
• Unusual modifications to Connector/J configuration files or JAR files
• Suspicious process behavior associated with Java applications using MySQL Connector/J

Detection Strategies

• Monitor network traffic for unusual MySQL protocol communications, particularly from administrative or high-privilege accounts
• Implement Java application logging to track Connector/J connection establishment and authentication events
• Deploy file integrity monitoring on MySQL Connector/J library files and configuration
• Utilize SentinelOne's behavioral AI to detect anomalous application behavior in Java-based systems using MySQL connectivity

Monitoring Recommendations

• Enable detailed logging for database connector initialization and connection pooling activities
• Monitor for version-specific signatures of vulnerable MySQL Connector/J versions (8.0.27 and prior)
• Implement alerting for privilege escalation attempts or unusual administrative actions against database connectors
• Review application dependencies regularly to identify outdated Connector/J versions

How to Mitigate CVE-2022-21363

Immediate Actions Required

• Upgrade MySQL Connector/J to version 8.0.28 or later, which addresses this vulnerability
• Review and restrict network access to systems running MySQL Connector/J to trusted sources only
• Audit high-privilege accounts that have access to MySQL Connectors and implement principle of least privilege
• Implement network segmentation to limit exposure of database connectors

Patch Information

Oracle has addressed this vulnerability in their January 2022 Critical Patch Update. Organizations should apply the security patch by upgrading to MySQL Connector/J version 8.0.28 or later. The official security advisory is available from the Oracle Critical Patch Update.

For applications using Quarkus that bundle MySQL Connector/J, ensure you are using a version of Quarkus that includes the patched connector dependency, or explicitly override the connector version in your dependency management.

Workarounds

• Restrict network access to MySQL Connector/J services using firewall rules and network access control lists
• Implement strict privilege management to minimize the number of high-privilege accounts with network access to the connectors
• Enable encrypted connections (SSL/TLS) for all MySQL Connector/J communications to reduce attack surface
• Consider using connection proxies or middleware that can provide additional authentication and monitoring layers
• Implement network intrusion detection systems to monitor for exploitation attempts against database connectors