Authenticated User Enrollment Seed Disclosure in MongoDB Ops Manager

Executive Summary

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This leads to the disclosure of secret authentication material to another member of the same organization or project.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthorized access to pending authenticator enrollment seeds via user-listing endpoints in MongoDB Ops Manager. To detect it, review logs for unusual access to user-listing endpoints by authenticated members during unconfirmed enrollment periods. Check for repeated or suspicious queries targeting these endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to the system could gain unauthorized access to another user's account by obtaining their authenticator enrollment seed. This could allow the attacker to impersonate the victim or bypass multi-factor authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update MongoDB Ops Manager to the latest patched version. Restrict access to user-listing endpoints to authorized personnel only. Monitor and audit user activities for any unauthorized access attempts. Disable or review pending authenticator enrollment processes until a fix is applied.

Useful 0 Not Useful 0