oss-sec mailing list archives
CVE request: mongodb: world-readable .dbshell history file
From: Sébastien Delafond <seb () debian org>
Date: Fri, 29 Jul 2016 15:16:18 +0000 (UTC)
Hello, from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832908: ,---- | During the report on redis-tools | (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832460), lamby@ | linked to a codesearch and the same bug was found in mongodb-clients. | | mongodb-clients stores its history in ~/.dbshell, this file is created | with permissions 0644. Home folders are world readable as well in | debian, so any user can access other users mongodb history, even though | db.auth commands don't appear to be logged like redis did. | | I filed a bug on upstream as well: | https://jira.mongodb.org/browse/SERVER-25335 `---- The mongodb client doesn't store authentication commands, but there's still information leakage, though, even if only about database and collection names, or data structure. As for data itself, the history could also contain sensitive information; for instance, if usernames for some other service were stored in a mongo collection, the history could contain lines like: db.users.find({user:"foo"}) or even: db.users.update({user:"foo"},{$set:{password:"OhComeOnNow"}}) Cheers, --Seb
Current thread:
- CVE request: mongodb: world-readable .dbshell history file Sébastien Delafond (Jul 29)
- Re: CVE request: mongodb: world-readable .dbshell history file cve-assign (Jul 29)
- Re: Re: CVE request: mongodb: world-readable .dbshell history file Grant Ridder (Aug 01)
- Re: CVE request: mongodb: world-readable .dbshell history file Sébastien Delafond (Aug 01)
- Re: Re: CVE request: mongodb: world-readable .dbshell history file Grant Ridder (Aug 01)
- Re: CVE request: mongodb: world-readable .dbshell history file cve-assign (Jul 29)