MongoDB vulnerabilities

In MongoDB 2.6, when using 2.4-style users, remote attackers can cause a denial of service by leveraging in-memory database representation when authenticating against a non-existent database.

MongoDB versions 3.4.x before 3.4.10 and 3.5.x-development have a disabled-by-default configuration setting, networkMessageCompressors, which when enabled can be exploited by a malicious attacker to deny service or modify memory.

During query planning in MongoDB, when reading the sort pattern in raw BSONObj form, some places do not explicitly handle the meta expression case. This may lead to incorrect transformations and invariant failure.

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents.

An authenticated user can cause the mongod process to be terminated by the OS under memory pressure by performing a specific data type conversion operation in MongoDB's aggregation framework. This requires write access and the ability to run aggregation queries.

An authenticated user can cause the mongod process to be terminated by the OS under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries.

MongoDB is vulnerable to a CPU exhaustion DoS attack. An unauthenticated client can send a specific combination of parameters to the hello command in exhaust mode, causing a response loop that bypasses normal throttling.

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until restart. The issue stems from an internal engine selection inconsistency.

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.

An authenticated user with read access can cause the mongod process to be terminated by the OS under memory pressure through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing.

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections.

An authenticated user can cause excessive CPU consumption or out-of-memory on a MongoDB server by sending a crafted Queryable Encryption find payload with an unvalidated field controlling an internal loop. Resource exhaustion degrades availability.

When PROXY protocol v2 is used on a Unix domain socket, roles from X.509 client certificates may not be validated against the tlsCATrusts allow-list, leading to unintended role assignments after MONGODB-X509 authentication.

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can leak internal process memory to clients. This affects deployments using server-side JavaScript.

A read-only user can craft an aggregation pipeline using the $linearFill operator with a specific sortBy expression, causing the mongod process to crash (denial of service).

Query operations involving deeply nested $jsonSchema constructs can cause excessive CPU consumption in affected MongoDB deployments, leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls.

An authenticated user with read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. The libmongocrypt library insufficiently validates payload-supplied values, leading to excessive memory allocation.

An authenticated user with write privileges on a Queryable Encryption-enabled collection may modify internal encryption metadata fields intended to be server-controlled by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness.

An authenticated user may view session metadata of other users through the $listSessions aggregation stage. This information is normally restricted to cluster-level administrators and includes active session identifiers, associated usernames, and activity timestamps.

An authenticated user with limited read privileges may access documents from unauthorized collections due to an inconsistency in the $graphLookup aggregation stage evaluation between authorization and execution. Affected scenarios involve collections referenced within existing view pipeline definitions.

An authenticated low-privileged user may perform unauthorized reads and writes on data protected by role-based query-level access controls due to insufficient validation of client-supplied command parameters. This affects find, update, delete, and aggregate commands in non-apiStrict configurations.

Vulnerability in MongoDB where an authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. This leads to an internal invariant failure and denial of service.

In MongoDB server, Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, $search and $searchMeta aggregation stages can be directly supplied by the client due to insufficient input validation.

Using expressions that generate large arrays, it is possible to craft a query that creates very large intermediate objects in memory, causing the server to crash with an out-of-memory (OOM) error.

The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fails to handle compound wildcard index specifications, triggering an internal consistency check that aborts the server process. The user must be able to run an aggregation pipeline.

The $_internalApplyOplogUpdate aggregation pipeline stage can be exploited to execute a document diff containing a malformed binary diff, resulting in out-of-bounds memory read or server crash. Any authenticated user with access to the aggregate command can trigger this.

An authorized user can trigger a server crash by running a query with a 2dsphere index on a field storing a GeoJSON GeometryCollection containing a Polygon with a strict-winding CRS. The guard does not inspect GeometryCollection members, leading to a null-pointer dereference.

The ldapQueryPassword parameter, when set through the runtime setParameter command, is logged to the mongod.log file in plain text.

An authenticated MongoDB user can crash the server or return incorrect results by creating documents that interfere with internal metadata processing during query execution. This stems from insufficient separation between user-controlled fields and internal metadata.

When running an aggregation pipeline using the internal $exchange stage with key-range partitioning and order-preserving delivery, if a single key range produces enough documents to fill its exchange buffer, the server reaches a code path where a full per-consumer buffer is detected but the internal high watermark for that key range is not updated as intended.

In MongoDB, the $_internalConvertBucketIndexStats stage uses PauseExecution as a signal to skip a document, but PauseExecution is only intended for coordinating sub-pipelines in $facet. When this stage is placed before $facet, TeeBuffer receives an unexpected signal and violates an assertion, crashing mongod.

Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash the MongoDB server.

Using $changestreams and $_requestReshardingResumeToken with the exchange option causes an invariant violation, leading to a server crash. No special privileges are needed, but the user must be logged in.

A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the $vectorSearch stage filter expressions being sent to the server as plaintext instead of ciphertext.

The MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, full authentication parameters are written without redaction.