Authentication bypass when using LDAP authentication in MongoDB Enterprise Server

Vulnerability

MongoDB Enterprise versions 3.0.0 through 3.0.6 (inclusive) improperly handle LDAP authentication [1]. When LDAP is enabled, the authentication mechanism "PLAIN" is exposed, allowing bypass. Only Enterprise edition is affected; Community edition is not.

Exploitation

An unauthenticated attacker can gain unauthorized access to a MongoDB instance or cluster by exploiting the LDAP authentication flaw. No authentication is required; the attacker simply needs network access to the MongoDB port. The vulnerability exists because the "PLAIN" mechanism is enabled, which can be checked via the db.adminCommand({getParameter: 1, authenticationMechanisms: 1}) command [1].

Impact

Successful exploitation allows an attacker to gain unauthorized access to the MongoDB instance or cluster, bypassing authentication. This leads to potential data disclosure, modification, or deletion, depending on the privileges of the accessed user [1].

Mitigation

Upgrade to MongoDB Enterprise 3.0.7, which includes the fix [1]. No workarounds are available. Affected users should upgrade as soon as possible. The Community edition is not vulnerable.