CVE-2021-20335 in Ops Manager
Summary
by MITRE • 02/11/2021
For MongoDB Ops Manager 4.2.X with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager 4.4.X triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2024
This vulnerability affects MongoDB Ops Manager 4.2.X deployments that utilize multiple application servers with SSL enabled for MongoDB processes. The issue manifests during the upgrade process to MongoDB Ops Manager 4.4.X where the Automation framework incorrectly determines that SSL should be disabled, temporarily compromising the security posture of the MongoDB cluster. The bug specifically targets environments where client certificate authentication is configured with clientCertificateMode=OPTIONAL or when allowConnectionsWithoutCertificates=true is enabled, making these configurations particularly susceptible to the vulnerability. This represents a critical configuration management flaw that can lead to unauthorized access and data exposure during the upgrade window.
The technical implementation of this vulnerability stems from a misconfiguration detection algorithm within the Ops Manager 4.4.X upgrade process that fails to properly recognize the existing SSL state of MongoDB processes. When the upgrade procedure executes, the Automation engine incorrectly interprets the presence of SSL-enabled MongoDB instances as evidence that SSL should be disabled, leading to temporary deactivation of SSL encryption for cluster members. This misidentification occurs specifically in multi-server deployments where the upgrade process cannot properly synchronize the SSL state across all application servers, creating a window of vulnerability that lasts until the upgrade process completes and the system stabilizes. The issue is classified as a configuration management error that falls under CWE-254, representing a weakness in security configuration that allows for temporary security degradation.
The operational impact of this vulnerability extends beyond the immediate upgrade period, as it creates a potential attack surface during the transition phase where MongoDB cluster communications may be exposed to man-in-the-middle attacks or unauthorized access attempts. During the temporary SSL disablement period, data transmitted between MongoDB instances and clients becomes vulnerable to interception and modification, potentially compromising sensitive database information. The vulnerability's temporary nature does not eliminate the risk, as attackers who become aware of the timing window could exploit this weakness to gain unauthorized access to database resources. This scenario aligns with ATT&CK technique T1071.004 for application layer protocol usage and T1566 for credential harvesting during system transitions, making it particularly concerning for organizations with high-security requirements. The vulnerability affects organizations that rely on MongoDB Ops Manager for cluster management and require continuous security posture maintenance throughout upgrade processes.
Organizations should implement immediate mitigations including ensuring that all MongoDB Ops Manager instances are properly synchronized before initiating upgrades, and verifying that client certificate modes are set to REQUIRE rather than OPTIONAL when possible. The recommended approach involves conducting thorough testing in non-production environments to validate the upgrade process and monitor for any SSL state changes during the transition. System administrators should also implement monitoring solutions that can detect unexpected SSL disablement events and alert security teams immediately. Additionally, organizations should consider implementing network-level controls such as firewall rules that enforce SSL requirements between MongoDB instances, providing defense-in-depth protection against potential exploitation of this vulnerability. The upgrade process should be carefully planned with rollback procedures in place to minimize the window of vulnerability, and all stakeholders should be informed about the potential security implications during the upgrade period. This vulnerability underscores the importance of thorough testing and validation of upgrade procedures in complex distributed systems, particularly those handling sensitive data where security configuration integrity is paramount.