Large aggregation pipelines with a specific stage can crash mongod under default configuration

Vulnerability

A stack overflow vulnerability exists in MongoDB's aggregation pipeline when a specific stage or operator is used in conjunction with an extremely long pipeline. The large stack frames consumed by that stage cause a stack overflow, leading to a crash. This affects MongoDB Server v4.4 versions prior to and including 4.4.28, v5.0 versions prior to 5.0.4, and v4.2 versions prior to 4.2.16. [1]

Exploitation

An attacker with network access to the MongoDB server can send a crafted aggregation query containing an extremely long pipeline with the vulnerable stage or operator. No authentication is required if the server is configured to allow unauthenticated queries. The query triggers the stack overflow, causing the server to crash.

Impact

Successful exploitation results in a denial of service (DoS) by crashing the MongoDB server. No data compromise, privilege escalation, or other impacts are possible.

Mitigation

Fixed versions are MongoDB Server v4.2.16, v4.4.10, v5.0.4, and later. [1] For users on v4.2.16 or later and all v4.4 users, a workaround is to set the parameter internalPipelineLengthLimit to 50 at startup. No workaround is available for v5.0 before 5.0.4; upgrading to the fixed version is required.