MongoDB versions 2.0.1, 2.1.1, 2.1.4, and 2.1.5 appear to suffer from multiple localized password disclosure issues.
Title: MongoDB MONGOSH Password Exposure Vulnerability
Product: MongoDB database
Tool: mongosh
Affected Version(s): 2.0.1 , 2.1.1,2.1.4,2.1.5
Tested Version(s): 2.0.1 , 2.1.1,2.1.4,2.1.5
Risk Level: Low
Author of Advisory: Emad Al-Mousa
*****************************************
Vulnerability Details:
Vulnerability in MongoDB database system "mongosh" which is a JavaScript and Node.js REPL environment for interacting with MongoDB deployments in Atlas , locally, or on another remote host. So, its basically a command line utility to run database commands and java scripts against back-end MongoDB database system.
MONGOSH has two vulnerbailites where passwords can be exposed and leaked in which an attacker to the operating system can weaponize for unauthorized access to the MongoDB database system.
*****************************************
Proof of Concept (PoC):
Vulnerability No1. : passwordPrompt() showing password displayed in clear text
per documentation:
https://www.mongodb.com/docs/manual/reference/method/passwordPrompt/#mongodb-method-passwordPrompt
The password should not be displayed, however I found out that it appears clearly in the prompt !
The password function passwordPrompt() was tested and used in conjunction with db.createUser, db.changeUserPassword, db.auth commands and all of them were allowing clear text password to appear.
admin> use admin
already on db admin
admin> db.createUser({user:"mongo2", pwd: passwordPrompt(), roles:["root"]})
Enter password
mongo
*****{ ok: 1 }
admin>
Vulnerability No2. : Password is exposed in mongosh_repl_history file with db.auth command
Mongosh was tested with both “remove”& “remove-redact” modes
config.set (redactHistory, “remove-redact”)
config.set (‘redactHistory’, “remove”)
In Linux Red Hat Environment the file: $MONGOHOME/.mongodb/mongosh/mongosh_repl_history
Contains the password in clear text for historical commands run for authentication db.auth() and db.createUser , per documentation: https://www.mongodb.com/docs/mongodb-shell/logs/ the logs should omit the credentials but this didn’t happen !
In windows operating system environment the file: C:Userswindows_profile_userAppDataRoamingmongodbmongosh
Commands running for database creation db.createUser and db.auth() are logging the username, password explicitly as shown below:
cat mongosh_repl_history
use admin
db.createUser({user:"mongo2", pwd: passwordPrompt(), roles:["root"]})
*****************************************
References:
https://databasesecurityninja.wordpress.com/2024/03/07/mongodb-mongosh-password-exposure-vulnerability/
https://www.mongodb.com/docs/manual/reference/method/passwordPrompt/#mongodb-method-passwordPrompt
https://www.mongodb.com/docs/mongodb-shell/logs/
