MongoDB Compass TLS Root Certificate Store Vulnerability

Executive Summary

This vulnerability involves MongoDB Compass relying on Electron, which includes a compromised eMudhra intermediate CA certificate in its TLS root store. Attackers could exploit this to issue fraudulent HTTPS certificates, enabling impersonation of websites and interception of user traffic. The issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is tied to compromised eMudhra intermediate CA certificates in Electron-based applications like MongoDB Compass. Detection involves checking installed Electron versions and verifying certificate trust stores. For MongoDB Compass, ensure you are running version 1.53.1 or later. Use commands like 'compass --version' to check your Compass version and 'npm list electron' in relevant projects to verify Electron versions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to impersonate websites and intercept sensitive user traffic, potentially leading to data theft or unauthorized access. Users of MongoDB Compass versions prior to 1.53.1 are at risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for protecting personal and health data. Organizations using affected versions of MongoDB Compass may face compliance risks and potential penalties.

Useful 0 Not Useful 0

Mitigation Strategies

• Update MongoDB Compass to version 1.53.1 or later to include Electron 44.9.1, which addresses the compromised certificate issue.
• For Electron-based applications, update to Electron v44.9.1 or newer via package managers like npm or yarn.
• Review and revoke any certificates issued by the compromised eMudhra intermediates in your infrastructure.
• Monitor for unusual certificate activity or HTTPS interception attempts on your network.

Useful 0 Not Useful 0