Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-8013— CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines

Quick assessment

Affected
MongoDB Inc mongocryptd
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MongoDB mongocryptd和MongoDB Mongo_crypt_v1.so都是美国MongoDB公司的产品。MongoDB mongocryptd是一个客户端加密库。MongoDB Mongo_crypt_v1.so是一个自动加密共享库，用于执行加密和解密操作。 MongoDB mongocryptd和MongoDB Mongo_crypt_v1.so存在安全漏洞，该漏洞源于某些查询分析中的错误，可能导致加密字段表达式中的字面值以明文形式而非密文形式发送到服务器。以下产品及版本受到影响：m

CVSS 2.2 · Low EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1556 · Modify Authentication Process
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-8013

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines
Source: CVE Program / CVE List V5
Vulnerability Description
A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
敏感数据的明文传输
Source: CVE Program / CVE List V5
Vulnerability Title
MongoDB mongocryptd和MongoDB Mongo_crypt_v1.so 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MongoDB mongocryptd和MongoDB Mongo_crypt_v1.so都是美国MongoDB公司的产品。MongoDB mongocryptd是一个客户端加密库。MongoDB Mongo_crypt_v1.so是一个自动加密共享库，用于执行加密和解密操作。 MongoDB mongocryptd和MongoDB Mongo_crypt_v1.so存在安全漏洞，该漏洞源于某些查询分析中的错误，可能导致加密字段表达式中的字面值以明文形式而非密文形式发送到服务器。以下产品及版本受到影响：m
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Inc mongocryptd 5.0 ~ 5.0.29 cpe:2.3:a:mongodb:mongo_crypt_v1.so:6.0.0:*:*:*:*:mongodb:*:*
MongoDB Inc Mongo_crypt_v1.so 6.0 ~ 6.0.17 -

II. Public POCs for CVE-2024-8013

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-8013

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same vendor: MongoDB Inc
Same weakness: CWE-319

V. Comments for CVE-2024-8013

No comments yet

Leave a comment