CVE-2021-32050: MongoDB Driver authentication data exposure in event publishing

CVE-2021-32050 · Severity: low · CVSS 3.1 · Published 2023-08-29

MongoDB drivers may expose authentication credentials and sensitive data through publicly available event listeners if applications enable this feature. An application developer using command listeners (a debugging/monitoring feature) could inadvertently log authentication secrets, compromising database credentials and user account security without any attacker action required.

Technologies: MongoDB C Driver, MongoDB Node.js Driver, MongoDB PHP Driver. Vendors: MongoDB, Swift.

Quick answers

Is CVE-2021-32050 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-32050 being exploited in the wild.
How severe is CVE-2021-32050?
Low severity, with a CVSS score of 3.1, published 29 August 2023.
Which products and versions are affected?
MongoDB C Driver prior to 3.7.0; MongoDB Node.js Driver 3.6.0 through 3.6.9, 4.0.0 through 4.16.x, 5.0.0 through 5.7.x; MongoDB PHP Driver 1.0.0 prior to 1.9.2; MongoDB Swift Driver 1.0.0 prior to 1.1.1; and 1 more.
Is there a fix for CVE-2021-32050?
Yes. github.com/mongodb/mongo-swift-driver (Swift): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32050 attacked?
It is attacked with local access.
Am I affected by CVE-2021-32050?
Check whether you run MongoDB C Driver, MongoDB Node.js Driver, MongoDB PHP Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mongodb/mongo-swift-driver (Swift): upgrade to 1.1.1 or later

Technical details

MongoDB drivers across multiple language bindings (C, C++, Node.js, PHP, Swift) publish authentication-related commands through command listener events without sanitizing sensitive data such as credentials. The vulnerability affects drivers when applications explicitly enable the command listener feature (disabled by default), which is intended for monitoring but can expose SASL authentication payloads, passwords, and connection strings to any handler that receives these events. An attacker with access to application logs or event handlers can retrieve plaintext authentication material. The issue stems from insufficient filtering of sensitive fields before event publication. Patches are available in MongoDB C Driver 1.17.7+, C++ Driver 3.7.0+, Node.js Driver 3.6.10/4.17.0/5.8.0+, PHP Driver 1.9.2+, and Swift Driver 1.1.1+.

Affected products

  • MongoDB C Driver 1.0.0 prior to 1.17.7
  • MongoDB C++ Driver prior to 3.7.0
  • MongoDB Node.js Driver 3.6.0 through 3.6.9, 4.0.0 through 4.16.x, 5.0.0 through 5.7.x
  • MongoDB PHP Driver 1.0.0 prior to 1.9.2
  • MongoDB Swift Driver 1.0.0 prior to 1.1.1

Identifiers

  • CVE-2021-32050
  • GHSA-vxvm-qww3-2fh7

Timeline

  • 2023-08-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.