mysql2 में `readCodeFor` फ़ंक्शन के माध्यम से रिमोट कोड एग्जीक्यूशन (RCE)

Successful exploitation of CVE-2024-21508 allows an attacker to execute arbitrary code on the system hosting the Node.js application utilizing the vulnerable mysql2 package. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The impact is particularly severe because mysql2 is a widely used package for interacting with MySQL databases in Node.js applications, meaning a large number of applications could be at risk. The ability to execute arbitrary code bypasses standard security controls and grants the attacker significant control over the affected system. This vulnerability shares similarities with other RCE flaws where improper input validation allows for code injection, potentially leading to similar attack vectors.

Applications utilizing the mysql2 Node.js package, particularly those handling user-supplied data without proper sanitization, are at significant risk. This includes web applications, APIs, and backend services that rely on MySQL databases. Development teams using older versions of Node.js or relying on outdated dependency management practices are also at increased risk.

• nodejs / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*node*'} | Select-Object Name, Path, CPU

• nodejs / supply-chain:

Get-Package -Name mysql2 | Select-Object Version

• generic web:

curl -I <your_node_app_url> | grep -i 'mysql2'

1. 2024-04-11Disclosure

   disclosure

1. आरक्षित2023-12-22
2. प्रकाशित2024-04-11
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-21508 is to immediately upgrade the mysql2 package to version 3.9.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. While not a complete solution, input validation on the supportBigNumbers and bigNumberStrings parameters before passing them to the readCodeFor function can reduce the attack surface. Monitor Node.js application logs for unusual activity or errors related to the mysql2 package. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the vulnerable function, although this is not a substitute for patching.