Executive brief
MongoDB drivers may expose authentication credentials and sensitive data through publicly available event listeners if applications enable this feature. An application developer using command listeners (a debugging/monitoring feature) could inadvertently log authentication secrets, compromising database credentials and user account security without any attacker action required.
Technical details
MongoDB drivers across multiple language bindings (C, C++, Node.js, PHP, Swift) publish authentication-related commands through command listener events without sanitizing sensitive data such as credentials. The vulnerability affects drivers when applications explicitly enable the command listener feature (disabled by default), which is intended for monitoring but can expose SASL authentication payloads, passwords, and connection strings to any handler that receives these events. An attacker with access to application logs or event handlers can retrieve plaintext authentication material. The issue stems from insufficient filtering of sensitive fields before event publication. Patches are available in MongoDB C Driver 1.17.7+, C++ Driver 3.7.0+, Node.js Driver 3.6.10/4.17.0/5.8.0+, PHP Driver 1.9.2+, and Swift Driver 1.1.1+.
Affected products
- MongoDB C Driver 1.0.0 prior to 1.17.7
- MongoDB C++ Driver prior to 3.7.0
- MongoDB Node.js Driver 3.6.0 through 3.6.9, 4.0.0 through 4.16.x, 5.0.0 through 5.7.x
- MongoDB PHP Driver 1.0.0 prior to 1.9.2
- MongoDB Swift Driver 1.0.0 prior to 1.1.1
Timeline
- 2023-08-29: disclosed