Full Report
MongoDB security advisory (AV26-810)
Analysis Summary
# Vulnerability: MongoDB Cleartext Keyfile Disclosure and Proxy Credential Masking Issues
## CVE Details
*Note: The provided advisory references internal Jira identifiers (SERVER-130264, JAVA-6266). Specific CVE IDs were not listed in the source text.*
- **CVE ID:** Pending / Not specified (Referenced as SERVER-130264 and JAVA-6266)
- **CVSS Score:** Not provided (Estimated High for SERVER-130264 due to credential disclosure)
- **CWE:** CWE-319 (Cleartext Transmission of Sensitive Information), CWE-532 (Insertion of Sensitive Information into Log File)
## Affected Systems
- **Products:** MongoDB Server and MongoDB Java Driver
- **Versions:**
- MongoDB Server:
- Prior to 7.0.40
- Prior to 8.0.29
- Prior to 8.2.13
- Prior to 8.3.8
- Prior to 9.0.0-rc2
- MongoDB Driver (Java):
- Prior to 5.9.2
- **Configurations:** Systems utilizing intra-cluster SASL authentication or proxy configurations with passwords.
## Vulnerability Description
Two distinct issues are identified:
1. **Intra-cluster SASL Downgrade (SERVER-130264):** A flaw in the egress connection setup where the intra-cluster SASL mechanism "allow list" is missing. This allows for a protocol downgrade to `PLAIN` authentication, which can lead to the disclosure of the cluster's internal keyfile in cleartext.
2. **Sensitive Information Logging (JAVA-6266):** The `ProxySettings.toString()` method in the MongoDB Java Driver fails to mask proxy passwords, potentially leaking credentials into application logs or monitoring tools.
## Exploitation
- **Status:** Not reported as exploited in the wild; PoC status unknown.
- **Complexity:** Medium (SERVER-130264 requires Man-in-the-Middle or control over a cluster node).
- **Attack Vector:** Network (Intra-cluster communication).
## Impact
- **Confidentiality:** High (Disclosure of internal cluster keyfiles and proxy passwords).
- **Integrity:** Medium (Keyfile disclosure could lead to unauthorized cluster access).
- **Availability:** Low.
## Remediation
### Patches
Users are advised to upgrade to the following versions or newer:
- **MongoDB Server:** 7.0.40, 8.0.29, 8.2.13, 8.3.8, or 9.0.0-rc2.
- **MongoDB Java Driver:** 5.9.2.
### Workarounds
- **Network Segmentation:** Ensure intra-cluster traffic is restricted to a trusted private network to prevent interception of cleartext credentials.
- **TLS/SSL Encryption:** Enforce TLS for all internal and external communications to mitigate cleartext disclosure during SASL negotiation.
- **Log Review:** For the driver issue, audit application logs for `ProxySettings` output and sanitize existing logs.
## Detection
- **Indicators of Compromise:** Monitor for unexpected `PLAIN` authentication requests in intra-cluster traffic logs.
- **Detection Methods:** Review application logs for cleartext proxy credentials. Use network security tools to inspect intra-cluster handshakes for SASL mechanism downgrades.
## References
- MongoDB Jira (SERVER-130264): hxxps[://]jira[.]mongodb[.]org/browse/SERVER-130264
- MongoDB Jira (JAVA-6266): hxxps[://]jira[.]mongodb[.]org/browse/JAVA-6266
- Canadian Centre for Cyber Security Advisory (AV26-810): hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/mongodb-security-advisory-av26-810