KMS request injection via unsanitized key vault and provider values in libmongocrypt
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.21.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
libmongocrypt, the client-side encryption library used with MongoDB, is affected when it sends requests to AWS, Azure, or GCP key management services. A user with write access to the key vault collection could alter those requests so that the library signs them with the application's credentials, potentially causing key operations to run with parameters the application did not intend.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encoding them for each context. A user with write access to the key vault collection can alter the structure of these requests, including adding members to request bodies and token claims that the library then signs with the application's credentials. This may result in key management operations being performed with parameters the application did not intend.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- MongoDB libmongocrypt
From 1.0.0 · fixed in 1.21.1