TLS Private Key Password Exposure in MongoDB Connector for BI

Executive Summary

This vulnerability in MongoDB Connector for BI involves mongodrdl writing a TLS private-key password to standard error when the password is provided via both the connection URI and a command-line option. A local attacker with access to the command output and encrypted key file could use the disclosed password to access the TLS client key.

Useful 0 Not Useful 0

Detection Guidance

Check command-line history or logs for instances where mongodrdl was executed with both a TLS private-key password in the connection URI and as a command-line option. Look for output containing the password in standard error or logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could decrypt TLS traffic or impersonate the client by obtaining the private key using the exposed password. This could lead to data breaches, unauthorized access to sensitive information, or man-in-the-middle attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of sensitive data in transit, such as GDPR's encryption standards or HIPAA's safeguards for protected health information. Failure to secure TLS keys may result in non-compliance penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid supplying the TLS private-key password in both the connection URI and command-line options simultaneously. Use one method only. Rotate any exposed passwords and keys immediately.

Useful 0 Not Useful 0