CVE-2024-21512: mysql2 Prototype Pollution Vulnerability

CVE-2024-21512 Overview

CVE-2024-21512 is a Prototype Pollution vulnerability affecting the popular mysql2 npm package before version 3.9.8. The vulnerability arises from improper user input sanitization when using the nestTables option with user-controlled field and table names. Attackers can exploit this flaw to pollute the JavaScript Object prototype, potentially leading to unauthorized data manipulation, integrity violations, or denial of service conditions.

Critical Impact

This vulnerability allows remote attackers to manipulate application behavior by injecting malicious properties into the Object prototype through crafted database queries using the nestTables feature.

Affected Products

• mysql2 npm package versions before 3.9.8
• org.webjars.npm:mysql2 (Java WebJars wrapper)
• Applications using mysql2 with the nestTables query option enabled

Discovery Timeline

• 2024-05-29 - CVE-2024-21512 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21512

Vulnerability Analysis

This Prototype Pollution vulnerability exists in the mysql2 package's handling of query results when the nestTables option is enabled. The nestTables feature organizes query results by table name, creating nested objects for each table's columns. However, the implementation fails to properly sanitize table and field names before using them as object property keys.

When an attacker can influence the table names or field names returned in a query result (such as through aliased columns or controlled table names), they can inject special property names like __proto__, constructor, or prototype. This allows modification of the base Object prototype, affecting all objects in the application's JavaScript runtime.

The vulnerability is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), which is a well-known class of vulnerabilities in JavaScript applications that can lead to property injection, denial of service, or in some cases, remote code execution depending on how the polluted properties are subsequently used.

Root Cause

The root cause of this vulnerability is the lack of input validation and sanitization when processing field and table names in the nestTables result transformation. The mysql2 package directly uses user-controllable strings as object keys without checking for dangerous prototype-related property names. This allows attackers to inject properties like __proto__ that bypass normal object property assignment and instead modify the prototype chain of all JavaScript objects.

Attack Vector

The attack is network-based and requires no authentication or user interaction, making it particularly dangerous for applications that expose database functionality. An attacker can exploit this vulnerability by:

1. Crafting a malicious database query that returns results with specially named columns or table aliases
2. Ensuring the application processes these results with nestTables enabled
3. Injecting prototype-polluting payloads such as __proto__ as table or field names
4. The polluted prototype properties then affect subsequent object operations throughout the application

The vulnerability can be exploited in scenarios where table names or column aliases are derived from user input, or where an attacker has control over the database schema being queried.

For technical details and proof of concept, refer to the GitHub Gist demonstrating the vulnerability.

Detection Methods for CVE-2024-21512

Indicators of Compromise

• Unusual database queries containing __proto__, constructor, or prototype as table aliases or column names
• Application crashes or unexpected behavior following database query execution
• Anomalous object property values appearing across unrelated application components
• Log entries showing failed assertions or type errors in code that doesn't typically handle prototype properties

Detection Strategies

• Implement application-level monitoring for queries using nestTables with suspicious column aliases
• Deploy Web Application Firewall (WAF) rules to detect prototype pollution payloads in request parameters
• Use Static Application Security Testing (SAST) tools to identify usage of vulnerable mysql2 versions
• Monitor npm dependency chains using Software Composition Analysis (SCA) tools like Snyk

Monitoring Recommendations

• Enable detailed logging for all database query operations, especially those using nestTables
• Implement runtime application self-protection (RASP) to detect prototype pollution attempts
• Configure alerting for unexpected object property modifications in critical application objects
• Monitor package.json and package-lock.json for outdated mysql2 versions in CI/CD pipelines

How to Mitigate CVE-2024-21512

Immediate Actions Required

• Upgrade the mysql2 package to version 3.9.8 or later immediately
• Audit application code for usage of the nestTables option with user-controlled inputs
• Review database queries to ensure table and column names are not derived from untrusted sources
• Implement Object.freeze on Object.prototype as a temporary defensive measure if immediate patching is not possible

Patch Information

The vulnerability has been addressed in mysql2 version 3.9.8. The fix implements proper sanitization of table and field names to prevent prototype pollution attacks. The patch can be reviewed in the GitHub commit efe3db527a2c94a63c2d14045baba8dfefe922bc. Additional context is available in the GitHub Pull Request #2702.

For vulnerability tracking details, see the Snyk JavaScript vulnerability report and Snyk Java vulnerability report for WebJars users.

Workarounds

• Disable the nestTables option if it is not required for application functionality
• Implement server-side validation to whitelist allowed table and column names before query execution
• Use parameterized queries and avoid dynamic table/column name construction from user input
• Consider using Object.create(null) for objects that will receive database query results to prevent prototype chain access

# Configuration example
# Update mysql2 to patched version
npm update mysql2@^3.9.8

# Verify installed version
npm list mysql2

# For yarn users
yarn upgrade mysql2@^3.9.8