2274489 – (CVE-2024-21509) CVE-2024-21509 mysql2: Prototype Poisoning

Bug 2274489 (CVE-2024-21509) - CVE-2024-21509 mysql2: Prototype Poisoning

Summary: CVE-2024-21509 mysql2: Prototype Poisoning

Keywords:
Status:	NEW
Alias:	CVE-2024-21509
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	2274445
TreeView+	depends on / blocked

Reported:	2024-04-11 10:33 UTC by ybuenos
Modified:	2024-05-14 04:40 UTC (History)
CC List:	5 users (show)
Fixed In Version:	mysql2 3.9.4
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Description ybuenos 2024-04-11 10:33:11 UTC

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

https://blog.slonser.info/posts/mysql2-attacker-configuration/
https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134
https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691
https://github.com/sidorares/node-mysql2/pull/2574
https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084

Note You need to log in before you can comment on or make changes to this bug.