A critical vulnerability in MariaDB Connector/Node.js allows unauthenticated attackers to intercept database credentials via man-in-the-middle attacks due to insufficient certificate validation.

This flaw involves improper certificate validation (CWE-295) and protection of credentials (CWE-522), where the connector transmits database credentials before verifying the server identity. An unauthenticated attacker positioned in the network path can intercept these credentials by presenting a self-signed certificate, even if the connection is eventually terminated by the client.

The vulnerability poses a severe risk to data confidentiality, as attackers can obtain database credentials to gain unauthorized access to backend systems. Given the CVSS score of 7.5, this high-severity issue could lead to widespread data breaches, unauthorized data modification, or complete system compromise. Organizations relying on this connector for secure database communication are at significant risk if their network environment is susceptible to interception.

Immediate Action: Update MariaDB Connector/Node.js to version 3.3.3, 3.4.6, 3.5.3, or later to incorporate the necessary identity verification patches.

Proactive Monitoring: Review database access logs for unusual connection patterns or authentication failures originating from unexpected IP addresses.

Compensating Controls: Ensure all database connections are configured with strictly pinned CA or server certificates to prevent the acceptance of untrusted certificates, and utilize network-level encryption or VPNs to minimize the risk of man-in-the-middle positioning.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to the integrity of database authentication processes. Security teams must prioritize upgrading the MariaDB Connector/Node.js library to the specified fixed versions across all production environments. Failure to patch allows for the potential theft of administrative database credentials, which may be leveraged to facilitate further unauthorized access and data exfiltration.