Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client. This issue affects all MongoDB Server v7.0 prior to 7.0.28 versions, MongoDB Server v8.0 versions prior to 8.0.17, MongoDB Server v8.2 versions prior to 8.2.3, MongoDB Server v6.0 versions prior to 6.0.27, MongoDB Server v5.0 versions prior to 5.0.32, MongoDB Server v4.4 versions prior to 4.4.30, MongoDB Server v4.2 versions greater than or equal to 4.2.0, MongoDB Server v4.0 versions greater than or equal to 4.0.0, and MongoDB Server v3.6 versions greater than or equal to 3.6.0.

Impact

Remote code execution on the host machine by any authenticated user.

Proof Of Concept

Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator:

javascript this.constructor.constructor("return process")().mainModule.require('childprocess').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')

Patches Users should upgrade to version 0.54.0

Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?

For more information If you have any questions or comments about this advisory: Open an issue in example link to repo Email us at example email address

Thanks

@JLLeitschuh for finding and reporting this vulnerability

This vulnerability has been exploited in the wild.