CVE-2023-21971: MySQL Connector/J DOS Vulnerability

CVE-2023-21971 Overview

CVE-2023-21971 is a vulnerability in the MySQL Connectors product of Oracle MySQL, specifically affecting the Connector/J component. This vulnerability allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Connectors when successful exploitation occurs with human interaction from a person other than the attacker.

Successful exploitation of this vulnerability can result in an unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of MySQL Connectors. Additionally, attackers may gain unauthorized update, insert, or delete access to some MySQL Connectors accessible data, as well as unauthorized read access to a subset of MySQL Connectors accessible data.

Critical Impact

Successful exploitation can lead to complete denial of service of MySQL Connectors, along with partial data integrity and confidentiality compromise affecting database connectivity in enterprise environments.

Affected Products

• Oracle MySQL Connectors 8.0.32 and prior (Connector/J)
• Oracle Communications Cloud Native Core Binding Support Function 22.4.0 and 23.1.0
• Oracle Communications Cloud Native Core Policy 22.4.0 and 23.1.0
• NetApp Active IQ Unified Manager (Linux, VMware vSphere, Windows)
• NetApp OnCommand Insight
• NetApp SnapCenter

Discovery Timeline

• April 18, 2023 - CVE-2023-21971 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-21971

Vulnerability Analysis

This vulnerability exists within the Connector/J component of Oracle MySQL Connectors. While the exact technical mechanism has not been publicly disclosed by Oracle (classified as NVD-CWE-noinfo), the vulnerability presents a multi-faceted risk affecting the confidentiality, integrity, and availability of the MySQL Connector infrastructure.

The attack requires high privileges and network access, combined with human interaction from a target other than the attacker. This suggests a potential social engineering or phishing-assisted attack vector where an attacker could manipulate a legitimate user into triggering malicious behavior through the connector interface.

The impact on availability is particularly severe, as successful exploitation can cause complete denial of service through system hangs or repeatable crashes. The confidentiality and integrity impacts are more limited, affecting only partial read access and partial data modification capabilities.

Root Cause

The specific root cause has not been disclosed by Oracle. Based on the vulnerability characteristics, this appears to be related to improper handling of certain inputs or protocol messages within the Connector/J Java database connectivity component. The requirement for high privileges and human interaction suggests the vulnerability may involve configuration or administrative functionality within the connector.

Attack Vector

The attack vector is network-based but requires several conditions to be met for successful exploitation:

1. The attacker must have high-privileged access to the target system
2. The attack must be conducted over the network via multiple protocols
3. Human interaction from a person other than the attacker is required
4. The attack complexity is high, meaning specific conditions must be met

This combination of requirements significantly limits the practical exploitability of the vulnerability in real-world scenarios. The vulnerability does not have known active exploitation in the wild and is not listed in CISA's Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2023-21971

Indicators of Compromise

• Unusual crash patterns or hangs in MySQL Connector/J processes
• Unexpected connection failures or timeouts in Java applications using MySQL connectivity
• Anomalous network traffic patterns to MySQL database servers from high-privileged accounts
• Unexplained modifications to MySQL Connectors accessible data

Detection Strategies

• Monitor MySQL Connector/J application logs for unexpected crashes or exceptions
• Implement network traffic analysis for abnormal MySQL protocol communications
• Deploy application performance monitoring to detect connector instability or denial of service conditions
• Review audit logs for high-privileged user activities involving MySQL Connectors

Monitoring Recommendations

• Enable verbose logging on MySQL Connector/J configurations to capture detailed connection and error information
• Configure alerting for MySQL Connector service interruptions or repeated crash events
• Implement database activity monitoring to track data access and modification patterns
• Deploy endpoint detection and response (EDR) solutions to correlate user interactions with connector behavior

How to Mitigate CVE-2023-21971

Immediate Actions Required

• Inventory all systems running Oracle MySQL Connectors 8.0.32 and prior versions
• Prioritize patching systems with high-privileged user access to MySQL Connectors
• Review and restrict network access to MySQL Connector services where possible
• Implement additional monitoring on affected systems until patches are applied

Patch Information

Oracle has released security patches addressing this vulnerability. Organizations should apply the latest MySQL Connector/J version as specified in the Oracle Critical Patch Update April 2023. Additional updates were provided in the Oracle Critical Patch Update July 2023.

For NetApp products, refer to the following security advisories:

• NetApp Security Advisory NTAP-20230427-0007
• NetApp Security Advisory NTAP-20230427-0010

Workarounds

• Restrict network access to MySQL Connector services to trusted networks and systems only
• Implement strict privilege management to limit the number of users with high-privileged access
• Enable connection pooling with proper timeout configurations to mitigate potential denial of service impacts
• Consider implementing a web application firewall (WAF) or network segmentation to add additional protection layers

# Example: Restrict MySQL Connector access via firewall rules
# Allow only specific trusted IP ranges to access MySQL services
iptables -A INPUT -p tcp --dport 3306 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Verify MySQL Connector/J version in your Java application
# Check the connector JAR file version
jar -tf mysql-connector-java-*.jar | grep -i version