MongoDB vulnerabilities

In MongoDB mongos, an authenticated user with readWrite privileges can crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage lacking proper authorization checks, allowing a subsequent stage to execute on the router under unintended conditions, resulting in an unhandled fatal error that immediately aborts mongos. This causes denial of service for all clients routed through the affected instance.

In MongoDB 2.6, when using 2.4-style users, remote attackers can cause a denial of service by leveraging in-memory database representation when authenticating against a non-existent database.

MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development have a disabled-by-default configuration setting, networkMessageCompressors, which when enabled can be exploited by a malicious attacker to deny service or modify memory.

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. This may lead to unauthorized access to protected resources.

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.

A vulnerability in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range numeric indices.

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate.

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients.

A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

During query planning in MongoDB, when reading the sort pattern in raw BSONObj form, some places do not explicitly handle the meta expression case. This may lead to incorrect transformations and invariant failure.

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

An authenticated user can cause the mongod process to be terminated by the OS under memory pressure by performing a specific data type conversion operation in MongoDB's aggregation framework. This requires write access and the ability to run aggregation queries.

An authenticated user can cause the mongod process to be terminated by the OS under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

MongoDB is vulnerable to a CPU exhaustion DoS attack. An unauthenticated client can send a specific combination of parameters to the hello command in exhaust mode, causing a response loop that bypasses normal throttling.

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until restart. The issue stems from an internal engine selection inconsistency.

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

An authenticated user with read access can cause the mongod process to be terminated by the OS under memory pressure through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections.

An authenticated user can cause excessive CPU consumption or out-of-memory on a MongoDB server by sending a crafted Queryable Encryption find payload with an unvalidated field controlling an internal loop. Resource exhaustion degrades availability.

When PROXY protocol v2 is used on a Unix domain socket, roles from X.509 client certificates may not be validated against the tlsCATrusts allow-list, leading to unintended role assignments after MONGODB-X509 authentication.

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can leak internal process memory to clients. This affects deployments using server-side JavaScript.

A read-only user can craft an aggregation pipeline using the $linearFill operator with a specific sortBy expression, causing the mongod process to crash (denial of service).

Query operations involving deeply nested $jsonSchema constructs can cause excessive CPU consumption in affected MongoDB deployments, leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

An authenticated user with read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. The libmongocrypt library insufficiently validates payload-supplied values, leading to excessive memory allocation.

An authenticated user with write privileges on a Queryable Encryption-enabled collection may modify internal encryption metadata fields intended to be server-controlled by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

An authenticated user may view session metadata of other users through the $listSessions aggregation stage. This information is normally restricted to cluster-level administrators and includes active session identifiers, associated usernames, and activity timestamps.

An authenticated user with limited read privileges may access documents from unauthorized collections due to an inconsistency in the $graphLookup aggregation stage evaluation between authorization and execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

An authenticated low-privileged user may perform unauthorized reads and writes on data protected by role-based query-level access controls due to insufficient validation of client-supplied command parameters. This affects find, update, delete, and aggregate commands in non-apiStrict configurations.

Vulnerability in MongoDB where an authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. This leads to an internal invariant failure and denial of service.

In MongoDB server, Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, $search and $searchMeta aggregation stages can be directly supplied by the client due to insufficient input validation.

Using expressions that generate large arrays, it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with an out-of-memory (OOM) error.

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

The $_internalApplyOplogUpdate aggregation pipeline stage can be exploited to execute a document diff containing a malformed binary diff, resulting in out-of-bounds memory read or server crash. Any authenticated user with access to the aggregate command can trigger this.

An authorized user can trigger a server crash by running a query with a 2dsphere index on a field storing a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. The guard does not inspect GeometryCollection members, leading to a null-pointer dereference.

The ldapQueryPassword parameter, when set through the runtime setParameter command, is logged to the mongod.log file in plain text.

An authenticated MongoDB user can crash the server or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled fields and internal metadata.

When running an aggregation pipeline using the internal $exchange stage with key-range partitioning and order-preserving delivery, if a single key range produces enough documents to fill its exchange buffer, the server reaches a code path where a full per-consumer buffer is detected but the internal high watermark for that key range is not updated as intended.

In MongoDB, the $_internalConvertBucketIndexStats stage uses PauseExecution as a signal to skip a document, but PauseExecution is only intended for coordinating sub-pipelines in $facet. When this stage is placed before $facet, TeeBuffer receives an unexpected signal and violates an assertion, crashing mongod.

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash the MongoDB server.

Using $changestreams and $_requestReshardingResumeToken with the exchange option causes an invariant violation, leading to a server crash. No special privileges are needed, but the user must be logged in.

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions being sent to the server as plaintext instead of ciphertext.

The MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, full authentication parameters are written without redaction.