CVE-2024-21508: mysql2 Package RCE Vulnerability

CVE-2024-21508 Overview

CVE-2024-21508 is a critical Remote Code Execution (RCE) vulnerability affecting the mysql2 npm package, a popular MySQL client for Node.js applications. Versions of the package before 3.9.4 are vulnerable to RCE via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings configuration values. This vulnerability allows attackers to execute arbitrary code on systems running vulnerable versions of the mysql2 package.

Critical Impact

Attackers can achieve full remote code execution on affected Node.js applications by exploiting improper input validation in the mysql2 text parser, potentially leading to complete system compromise.

Affected Products

• mysql2 npm package versions prior to 3.9.4
• Node.js applications using vulnerable mysql2 versions
• Any backend services utilizing mysql2 for MySQL database connectivity

Discovery Timeline

• April 11, 2024 - CVE-2024-21508 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-21508

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in the readCodeFor function within the mysql2 text parser (text_parser.js). The root cause is improper validation of user-controllable configuration options, specifically the supportBigNumbers and bigNumberStrings parameters. When these values are not properly sanitized, an attacker who can influence the connection configuration can inject malicious code that gets executed during query result parsing.

The mysql2 package dynamically generates code based on configuration options to optimize performance when handling large numbers. However, insufficient input validation allows specially crafted configuration values to break out of the intended code context and execute arbitrary JavaScript code.

Root Cause

The vulnerability stems from improper validation of the supportBigNumbers and bigNumberStrings configuration values in the readCodeFor function. These parameters are intended to control how the parser handles large numeric values from MySQL, but the lack of proper sanitization allows attackers to inject arbitrary code through these configuration options. The parser dynamically constructs code based on these values without adequate input validation, creating a code injection vector.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker who can control or influence the mysql2 connection configuration parameters can exploit this vulnerability. This scenario may occur in applications that:

• Accept database connection parameters from untrusted sources
• Allow user-controlled configuration values to be passed to mysql2
• Use environment variables or external configuration files that can be manipulated

When a vulnerable application processes a database query with malicious configuration values, the injected code executes within the Node.js process context, potentially granting the attacker complete control over the application and underlying system.

For detailed technical analysis of the exploitation technique, refer to the Slonser Blog Post which documents the attacker configuration methodology.

Detection Methods for CVE-2024-21508

Indicators of Compromise

• Unexpected process spawning from Node.js applications using mysql2
• Anomalous network connections originating from backend services
• Unusual file system access patterns from Node.js processes
• Modified or suspicious configuration values in mysql2 connection settings

Detection Strategies

• Monitor application logs for unusual mysql2 configuration parameters
• Implement runtime application self-protection (RASP) to detect code injection attempts
• Use software composition analysis (SCA) tools to identify vulnerable mysql2 versions
• Deploy network monitoring to detect suspicious outbound connections from Node.js applications

Monitoring Recommendations

• Audit all mysql2 package versions across your Node.js applications using npm audit
• Implement dependency scanning in CI/CD pipelines to catch vulnerable versions
• Monitor for unusual JavaScript execution patterns in application runtime environments
• Review database connection configuration sources for potential tampering

How to Mitigate CVE-2024-21508

Immediate Actions Required

• Update mysql2 package to version 3.9.4 or later immediately
• Audit all applications using mysql2 for vulnerable versions
• Review configuration sources to ensure database connection parameters cannot be controlled by untrusted input
• Implement input validation for any user-controllable configuration values

Patch Information

The vulnerability has been addressed in mysql2 version 3.9.4. The fix was implemented through GitHub Node MySQL2 Pull Request and committed via GitHub Node MySQL2 Commit. The patched version is available at GitHub Node MySQL2 Release v3.9.4. Additional vulnerability details are available in the Snyk Vulnerability Report.

Workarounds

• Ensure supportBigNumbers and bigNumberStrings configuration options are explicitly set to boolean values and not derived from untrusted input
• Validate all mysql2 configuration parameters before establishing connections
• Implement application-level input sanitization for any configuration values that could influence database connections
• Consider using a web application firewall (WAF) to filter potentially malicious configuration payloads

# Update mysql2 to patched version
npm update mysql2@3.9.4

# Verify installed version
npm list mysql2

# Audit for vulnerable packages
npm audit