Unauthenticated attackers can read sensitive server memory via MongoDB Zlib compression flaws
An unauthenticated client can trigger a memory leak in MongoDB by exploiting mismatched length fields in Zlib compressed protocol headers. This allows the reading of uninitialized heap memory from the server. Immediate upgrades to fixed versions are required to mitigate this high-severity flaw.
Summary
A critical vulnerability in the Zlib implementation of MongoDB Server permits an unauthenticated attacker to access sensitive data residing in the server's heap memory. The flaw stems from how the server handles protocol headers when using Zlib compression. By sending specially crafted messages with mismatched length fields, a client can force the server to return uninitialized memory segments.
The vulnerability affects multiple major versions of MongoDB Server, ranging from legacy 3.6 releases up to current 8.2 branches. Because the exploit does not require authentication, any entity capable of reaching the database network interface can attempt to trigger the memory leak.
Technical details
The core of the issue lies in the server's Zlib compression handling. When a client interacts with the MongoDB protocol using Zlib, the server processes compressed headers to manage data transmission.
A mismatch between the length fields provided in these headers and the actual data processed can lead to a memory disclosure condition. This allows an attacker to read uninitialized heap memory that may contain fragments of previously handled data or sensitive system information.
Affected products and fixed versions
The vulnerability impacts several generations of MongoDB Server. While newer versions are prioritized for updates, legacy versions also require immediate attention.
| Version Range | Fixed Version |
|---|---|
| 8.2.x | 8.2.3 |
| 8.0.x | 8.0.17 |
| 7.0.x | 7.0.28 |
| 6.0.x | 6.0.27 |
| 5.0.x | 5.0.32 |
| 4.4.x | 4.4.30 |
The following versions are also confirmed to be affected:
- All MongoDB Server v4.2 versions
- All MongoDB Server v4.0 versions
- All MongoDB in the 3.6 series
Defender guidance
The primary defense is to upgrade the MongoDB instance to one of the fixed versions listed above. These updates include hardening for Zlib decompression to prevent the length field mismatch.
If an immediate upgrade is not possible, defenders can mitigate the risk by disabling Zlib compression entirely on the server. This can be achieved by starting mongod or mongos with a networkMessageCompressors or a net.compression.compressors option that explicitly omits zlib.
Safe configuration values to use instead of zlib include:
- snappy
- zstd
- disabled (no compression)
Sources
