CVE-2024-21170: Oracle MySQL Connector/Python SQLi Flaw

CVE-2024-21170 Overview

CVE-2024-21170 is a vulnerability in the MySQL Connectors product of Oracle MySQL, specifically affecting the Connector/Python component. This easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful exploitation can result in unauthorized update, insert, or delete access to some MySQL Connectors accessible data, unauthorized read access to a subset of MySQL Connectors accessible data, and the ability to cause a partial denial of service (partial DoS) of MySQL Connectors.

Critical Impact

Low-privileged attackers can achieve unauthorized data manipulation, data exfiltration, and service disruption against MySQL Connector/Python deployments via network-based attacks.

Affected Products

• Oracle MySQL Connector/Python version 8.4.0 and prior

Discovery Timeline

• 2024-07-16 - CVE-2024-21170 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21170

Vulnerability Analysis

This vulnerability resides in the Connector/Python component of Oracle MySQL Connectors. The flaw is characterized as easily exploitable, requiring only low-privileged access and network connectivity. The attack can be conducted through multiple protocols, making it accessible to attackers with various network positions. The impact spans all three security domains: confidentiality, integrity, and availability, though each is affected at a limited level.

The vulnerability allows attackers to perform unauthorized data operations including reading, modifying, inserting, and deleting data within the scope of MySQL Connectors accessible data. Additionally, attackers can disrupt service availability, though only to a partial degree. No user interaction is required for exploitation, and the scope remains unchanged, meaning the vulnerable component cannot impact resources beyond its security scope.

Root Cause

Oracle has not disclosed specific technical details about the root cause of this vulnerability. The vulnerability is classified under NVD-CWE-noinfo, indicating that insufficient information is available to map to a specific CWE category. Based on the vulnerability characteristics—network-exploitable, requiring low privileges, and affecting data confidentiality, integrity, and availability—the issue likely involves improper access control or input validation within the Connector/Python component.

Attack Vector

The attack vector for CVE-2024-21170 is network-based, allowing remote exploitation. An attacker with low-level privileges and network access to the MySQL Connector/Python component can exploit this vulnerability through multiple protocols. The attack requires no user interaction, making it particularly dangerous in environments where the connector is exposed to untrusted network segments or users.

The exploitation process involves establishing a network connection to the vulnerable MySQL Connector/Python instance and leveraging the flaw to perform unauthorized operations. The specific technical mechanism has not been publicly disclosed by Oracle, but the low attack complexity suggests that exploitation does not require specialized conditions or extensive preparation.

Detection Methods for CVE-2024-21170

Indicators of Compromise

• Unexpected database queries or data modifications originating from MySQL Connector/Python connections
• Anomalous network traffic patterns to MySQL Connector/Python instances from unusual sources
• Unauthorized data access attempts logged in database audit trails
• Partial service disruptions or performance degradation in MySQL Connector/Python operations

Detection Strategies

• Monitor MySQL Connector/Python connection logs for suspicious authentication patterns or unusual query volumes
• Implement database activity monitoring to detect unauthorized read, insert, update, or delete operations
• Deploy network-level monitoring to identify abnormal traffic patterns targeting MySQL Connector instances
• Review application logs for error messages or exceptions that may indicate exploitation attempts

Monitoring Recommendations

• Enable detailed logging for all MySQL Connector/Python connections and database operations
• Configure alerting for failed authentication attempts and privilege escalation activities
• Implement real-time monitoring of database transaction patterns to identify anomalies
• Establish baseline behavior profiles for normal Connector/Python operations to detect deviations

How to Mitigate CVE-2024-21170

Immediate Actions Required

• Upgrade MySQL Connector/Python to a patched version as specified in Oracle's July 2024 Critical Patch Update
• Review and restrict network access to MySQL Connector/Python instances to trusted sources only
• Audit user privileges and ensure the principle of least privilege is enforced for all connector users
• Implement network segmentation to isolate MySQL Connector deployments from untrusted networks

Patch Information

Oracle has addressed this vulnerability in their July 2024 Critical Patch Update. Organizations using MySQL Connector/Python version 8.4.0 or prior should consult the Oracle Security Alert July 2024 for detailed patching instructions and the latest secure versions. Apply the recommended patches as soon as possible to remediate this vulnerability.

Workarounds

• Restrict network access to MySQL Connector/Python instances using firewall rules to limit exposure to trusted IP addresses only
• Implement strong authentication mechanisms and review all user accounts with connector access
• Deploy network-level access controls to prevent unauthorized protocol access to the connector
• Consider temporarily disabling non-essential protocols if multiple protocol access is not required

# Example: Restrict MySQL Connector access using firewall rules (iptables)
# Allow only trusted application servers to connect
iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP

# Review and audit MySQL user privileges
# Connect to MySQL and review connector user permissions
mysql -u admin -p -e "SELECT user, host, authentication_string FROM mysql.user;"