MySQL2 Vulnerability: Potential Plaintext Credential Leak
- Severity
- HIGH
- Affected component
- mysql2 (npm)
- Affected versions
- < 3.22.0 or < 3.9.4 or < 3.9.7 or < 3.9.4 or < 3.9.3 or < 3.9.8 or < 3.23.1
- Patched version
- Not yet available
An early warning has been issued for a high-severity vulnerability in the mysql2 npm package. This vulnerability may cause the package to leak plaintext credentials under certain conditions.
What happened
A potential security flaw has been identified in the mysql2 npm package. This flaw involves the possibility of a rogue MySQL server forcing mysql2 to send credentials in plaintext. This occurs when the server requests an authentication switch to `mysql_clear_password`. The mysql2 driver may comply with this request without verifying that a Transport Layer Security (TLS) connection is active. This behavior could lead to the exposure of sensitive credentials in plaintext form.
The vulnerability affects versions of mysql2 prior to 3.22.0, 3.9.4, 3.9.7, 3.9.3, 3.9.8, and 3.23.1. It is crucial for users of these versions to assess their exposure and take appropriate action to mitigate the risk.
What to do about it
- Remove `mysql_clear_password` from `standardAuthPlugins` in your configuration.
- Add a guard to require TLS or a unix socket before allowing cleartext authentication.
- Update to a non-affected version of mysql2 if available.
- Monitor the provided sources for updates on the vulnerability and any official fixes.
How 0Day would have caught this
mysql2 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using mysql2 versions prior to 3.22.0, 3.9.4, 3.9.7, 3.9.3, 3.9.8, or 3.23.1.
What should I do right now?
Remove `mysql_clear_password` from `standardAuthPlugins` and add a guard for TLS or unix socket authentication. Check for updates and consider upgrading to a non-affected version.
Is there an official patch available?
No official patch has been published yet. Monitor the sources for updates.