EventStoreDB Projections Subsystem has potential password leak

Vulnerability

The vulnerability resides in the projections subsystem of EventStoreDB. Only database instances that use custom projections are affected. Affected versions include 20.x before 20.10.6, 21.x before 21.10.11, 22.x before 22.10.5, and 23.x before 23.10.1 [2].

Exploitation

An attacker with access to chunk files on disk or read access to system streams can potentially obtain user passwords. By default, only users in the $admins group can access system streams [2]. The exploitation requires the ability to read chunk files or have system stream read access.

Impact

Successful exploitation could lead to disclosure of user passwords, compromising confidentiality. The attacker gains access to credentials that may be reused in other systems [2].

Mitigation

Upgrade to fixed versions: 23.10.1, 22.10.5, 21.10.11, 20.10.6 [2]. Additionally, reset passwords for current and previous members of $admins and $ops groups. If a password was reused, reset it elsewhere [2]. If upgrade cannot be done immediately, reset those passwords and avoid creating custom projections until patched [2]. The fix is also documented in commit [4].