CVE-2019-2390 : What You Need to Know
Learn about CVE-2019-2390, a vulnerability in MongoDB Server allowing code execution on Windows systems via OpenSSL engine injection. Find mitigation steps and preventive measures here.
An unprivileged user or program on Microsoft Windows can exploit OpenSSL configuration files to execute unauthorized code in MongoDB Server versions prior to 4.0.11, 3.6.14, and 3.4.22.
Understanding CVE-2019-2390
This CVE involves a vulnerability in MongoDB Server that allows code execution on Windows systems through OpenSSL engine injection.
What is CVE-2019-2390?
This CVE refers to the ability of an unprivileged user or program on Windows to manipulate OpenSSL configuration files, leading to the execution of unauthorized code in MongoDB Server.
The Impact of CVE-2019-2390
The vulnerability poses a high-risk threat with a CVSS base score of 8.2, affecting confidentiality, integrity, and availability of MongoDB Server.
Technical Details of CVE-2019-2390
This section provides detailed technical insights into the vulnerability.
Vulnerability Description
The presence of OpenSSL configuration files in a specific directory on Windows allows unauthorized code execution by a user or program in MongoDB Server.
Affected Systems and Versions
- MongoDB Server 4.0 prior to 4.0.11
- MongoDB Server 3.6 prior to 3.6.14
- MongoDB Server 3.4 prior to 3.4.22
Exploitation Mechanism
- An unprivileged user or program creates OpenSSL configuration files in a fixed location on Windows.
- This action triggers utility programs in MongoDB Server to run attacker-defined code as the user running the utility.
Mitigation and Prevention
Protecting systems from CVE-2019-2390 requires immediate actions and long-term security practices.
Immediate Steps to Take
- Update MongoDB Server to versions 4.0.11, 3.6.14, or 3.4.22 to mitigate the vulnerability.
- Monitor and restrict access to OpenSSL configuration files on Windows systems.
Long-Term Security Practices
- Implement least privilege access to limit user capabilities.
- Regularly audit and secure file permissions on Windows systems.
Patching and Updates
- Apply security patches provided by MongoDB Inc. promptly to address vulnerabilities and enhance system security.