MongoDB Python Driver Key Management Socket Misinterpretation

Executive Summary

The MongoDB Python Driver's client-side field level encryption feature incorrectly treats a key management endpoint ending in .sock as a local Unix domain socket path instead of a remote host. This allows an attacker with write access to encryption key metadata to force the application to connect to local sockets on the host machine.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the MongoDB Python Driver incorrectly handling key management endpoints ending in .sock as local Unix domain sockets. To detect it, inspect network connections for unexpected local socket usage by applications using the driver. Check for processes using Unix domain sockets with commands like 'ss -lpn | grep .sock' or 'netstat -lpn | grep .sock' on Linux systems.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to cause the application to send TLS handshake data to local sockets, potentially exposing limited network traffic. However, no chosen content is transmitted, reducing the immediate impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized local socket connections on the application host. However, since no sensitive data is transmitted beyond the start of a TLS handshake, the actual risk to compliance may be limited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the MongoDB Python Driver to the latest version that fixes this issue. Restrict write access to encryption key metadata in the database to prevent unauthorized modifications. Monitor network connections for unusual local socket activity.

Useful 0 Not Useful 0