CVE-2013-2132

Pymongo < 2.5.2 Denial of Service via invalid DBRef, NULL pointer dereference

• CVSS 4.3
• CWE-476: NULL Pointer Dereference
• Input Validation and Sanitization
• Remote

bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."

CVE

CVE-2013-2132

CWE

CWE-476: NULL Pointer Dereference

CVSS base score

4.3

Published

2013-08-15

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update pymongo to version 2.5.2 or higher.

import bson

def decode_dbref(dbref):
    return bson.decode_all(bson.BSON.encode(dbref))

invalid_dbref = {'$ref': None, '$id': None}
result = decode_dbref(invalid_dbref)
print(result)

import bson

def decode_dbref(dbref):
    try:
        if not isinstance(dbref, dict):
            raise ValueError("Invalid DBRef: Must be a dictionary")
        
        if '$ref' not in dbref or '$id' not in dbref:
            raise ValueError("Invalid DBRef: Missing '$ref' or '$id'")
        
        return bson.decode_all(bson.BSON.encode(dbref))
    except Exception as e:
        print(f"Error decoding DBRef: {e}")
        return None

dbref = {'$ref': 'collection_name', '$id': 'some_id'}
result = decode_dbref(dbref)
print(result)

@misc{vaitp:cve20132132,
  title        = {{Pymongo < 2.5.2 Denial of Service via invalid DBRef, NULL pointer dereference}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2013},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-2132},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-2132/}}
}