GHSA-6gjm-424r-3jh2: Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to cross-user authentication confusion?
Applications are exposed when they create MongoDB C# Driver clients using TLS certificates supplied by different users and allow those clients to share cached connections. The issue can cause a connection authenticated for one user to be reused for another user.
What does an attacker need to exploit this issue?
The attacker needs to supply a certificate with the same issuer and serial number as another user's certificate. They do not need the other user's private key.
What is the potential impact of a successful exploit?
The attacker's database operations can run under the other user's authenticated identity. This can affect the confidentiality and integrity of data that identity is authorized to access.