CVE-2024-21511 — AI Deep Analysis Summary

🚨 **Essence**: A critical code injection flaw in `mysql2` (Node.js MySQL client). <br>💥 **Consequences**: Attackers can execute arbitrary code on the server.…

🛡️ **Root Cause**: **CWE-94** (Code Injection). <br>🔍 **The Flaw**: Improper sanitization of the `timezone` parameter in the `readCodeFor` function.…

📦 **Affected**: The `mysql2` package for Node.js. <br>⚠️ **Versions**: All versions **prior to 2.3.9.7**. <br>👤 **Developer**: Andrey Sidorov. If you are using an older version, you are vulnerable.

👮 **Privileges**: The attacker gains the same privileges as the Node.js process running the app. <br>📊 **Data**: Full access to read, modify, or delete data.…

📉 **Threshold**: **LOW**. <br>🔑 **Auth**: No authentication required (PR:N). <br>🖱️ **UI**: No user interaction needed (UI:N). <br>🌍 **Access**: Network accessible (AV:N). <br>⚡ **Complexity**: Low (AC:L).…

🚫 **Public Exploit**: **No**. The `pocs` field is empty in the data. <br>📝 **Status**: While no public PoC is listed, the vulnerability details are clear.…

🔍 **Self-Check**: Scan your `package-lock.json` or `yarn.lock`. <br>🔎 **Look For**: `mysql2` version number. <br>✅ **Action**: If the version is `< 2.3.9.7`, you are at risk.…

🛠️ **Fixed**: **YES**. <br>💊 **Patch**: Version **3.9.7** (and likely 2.3.9.7 based on description) contains the fix. <br>🔗 **Source**: See GitHub commit `7d4b098` and PR `#2608`.…

🚧 **No Patch?**: If you cannot upgrade, implement strict input validation on any timezone-related parameters passed to `mysql2`.…

🔥 **Urgency**: **CRITICAL**. <br>⏳ **Priority**: Patch **IMMEDIATELY**. <br>📉 **Reason**: CVSS score indicates High impact with Low complexity and No auth required. This is a 'zero-day' style risk profile. Do not wait.