CVE-2024-21511: 
JavaScript vulnerability analysis and mitigation

CVE-2024-21511 affects versions of the mysql2 package before 3.9.7. The vulnerability is related to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function when calling a native MySQL Server date/time function. The vulnerability was discovered by zhaoyudi from Nebulalab and disclosed on April 21, 2024 (Snyk Report, GitHub Release).

The vulnerability exists because the node-mysql2 library allows the first argument passed to the connection query function to be a string containing the query, but this argument is not validated correctly. This allows users to pass objects instead of strings. The library generates a parsing function for every query, which is usually cached for optimization purposes. The vulnerability specifically relates to the improper sanitization of the timezone parameter, which could be exploited to inject arbitrary code. The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical) (Snyk Report).

The vulnerability could lead to a complete compromise of system confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code on the affected system, leading to unauthorized access to sensitive information, modification of data, or disruption of services (Snyk Report).

The vulnerability is remotely exploitable without requiring authentication or user interaction. Snyk has confirmed the existence of a proof-of-concept exploit. The exploit involves manipulating the timezone parameter in SQL queries to inject malicious code that can be executed on the target system (Snyk Report, Security Online).

The vulnerability has been patched in mysql2 version 3.9.7. Users are strongly recommended to upgrade to this version or later to address the security issue. The fix involves proper sanitization of the timezone parameter value to prevent code injection (GitHub Release, GitHub PR).