CVE-2022-21363: Oracle MySQL Connectors Privilege Escalation

CVE-2022-21363 Overview

CVE-2022-21363 is a vulnerability in the Oracle MySQL Connectors product, specifically the Connector/J component. Supported versions affected include 8.0.27 and prior. The flaw also impacts Quarkus, which bundles the affected connector. Successful exploitation can result in full takeover of MySQL Connectors with high impact to confidentiality, integrity, and availability. Exploitation requires high privileges and network access via multiple protocols, and the attack complexity is high.

Critical Impact
A high-privileged network attacker who successfully exploits this flaw can take over the MySQL Connectors component, compromising connected applications that rely on Connector/J for database access.

Affected Products

Oracle MySQL Connectors (Connector/J), versions 8.0.27 and prior
Quarkus framework versions that bundle the affected Connector/J library
Applications using mysql-connector-java 8.0.27 or earlier for MySQL connectivity

Discovery Timeline

2022-01-19 - CVE-2022-21363 published to NVD
2022-01 - Oracle releases fix in the January 2022 Critical Patch Update
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21363

Vulnerability Analysis

The vulnerability resides in the Connector/J component of Oracle MySQL Connectors. Connector/J is the official Java Database Connectivity (JDBC) driver for MySQL. The flaw allows a high-privileged attacker with network access via multiple protocols to compromise the connector. Successful exploitation results in takeover of MySQL Connectors, affecting downstream Java applications.

The issue is also tracked against Quarkus because the framework integrates the vulnerable Connector/J library for MySQL data sources. Applications that load the affected mysql-connector-java artifact inherit the risk. The CWE classification for this entry is NVD-CWE-noinfo, indicating Oracle did not publicly disclose the underlying weakness class.

Root Cause

Oracle did not publish technical specifics for this issue beyond the Critical Patch Update advisory. The affected component is the JDBC driver responsible for client-side handling of the MySQL wire protocol. The vulnerability requires that an attacker already hold high privileges, suggesting that exploitation depends on existing access to systems or protocols interacting with Connector/J.

Attack Vector

The attack vector is network-based with high complexity. The attacker must already hold high privileges before exploitation. No user interaction is required, and the scope is unchanged. Once exploited, the attacker gains the ability to compromise confidentiality, integrity, and availability of the connector and any Java application relying on it. Refer to the Oracle Security Alert January 2022 advisory for vendor details.

Detection Methods for CVE-2022-21363

Indicators of Compromise

Presence of mysql-connector-java version 8.0.27 or earlier in Java application classpaths, WEB-INF/lib directories, or Maven/Gradle dependency trees
Quarkus applications declaring quarkus-jdbc-mysql extensions tied to vulnerable Connector/J releases
Unexpected outbound connections from Java application servers to unauthorized MySQL endpoints

Detection Strategies

Run software composition analysis (SCA) against Java artifacts to enumerate mysql-connector-java versions across build pipelines and production hosts
Inventory Quarkus deployments and verify the bundled JDBC driver version against the Oracle January 2022 advisory
Correlate JDBC driver versions reported by application telemetry with the vulnerable version range to surface exposed services

Monitoring Recommendations

Alert on Java processes loading outdated mysql-connector-java JARs through endpoint telemetry
Monitor MySQL connection logs for anomalous client behavior originating from application servers using Connector/J
Track changes to dependency manifests (pom.xml, build.gradle) for reintroduction of vulnerable connector versions

How to Mitigate CVE-2022-21363

Immediate Actions Required

Upgrade mysql-connector-java to the version released in the Oracle January 2022 Critical Patch Update or later
Update Quarkus applications to a release that ships with a patched Connector/J dependency
Audit application dependency manifests and rebuild affected services after upgrading

Patch Information

Oracle addressed CVE-2022-21363 in the January 2022 Critical Patch Update. Apply the fixed Connector/J release as documented in the Oracle Security Alert January 2022. Quarkus users should align their BOM to a release that pulls a patched mysql-connector-java artifact.

Workarounds

Restrict network access to MySQL endpoints so only trusted application hosts can reach them, reducing exposure to high-privileged attackers
Enforce least privilege on database accounts and application service identities to limit the impact of connector compromise
Isolate Java application servers running unpatched connectors in segmented network zones until upgrades are completed

bash

# Verify the deployed Connector/J version in a Maven project
mvn dependency:tree | grep mysql-connector-java

# Upgrade to a fixed release (example version - confirm against Oracle CPU)
mvn versions:use-latest-versions -Dincludes=mysql:mysql-connector-java