CVE-2024-21506

Out-of-bounds Read vulnerability in pymongo bson module before 4.6.3.

• CVSS 5.2
• CWE-125
• Memory Corruption
• Remote

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the following bytes are not printable UTF-8 the parser throws an exception with a single byte.

CVE

CVE-2024-21506

CWE

CWE-125

CVSS base score

5.2

Published

2024-04-06

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Out-of-Bound Accesses

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

pymongo

Fixed by upgrading

Yes

Solution

Upgrade to pymongo version 4.6.3 or later.

import pymongo
from bson import BSON

data = b'\x16\x00\x00\x00\x02name\x00\x05\x00\x00\x00Alice\x00\x00\xff\xff\xff'

try:
    document = BSON(data).decode()
    print(document)
except Exception as e:
    print(f'Error: {e}')

import pymongo
from bson import BSON

data = b'\x16\x00\x00\x00\x02name\x00\x05\x00\x00\x00Alice\x00\x00\xff\xff\xff'

try:
    if data:
        document = BSON(data).decode()
        print(document)
    else:
        print("Empty data received")
except Exception as e:
    print(f'Error: {e}')

malicious_payload = b'\x16\x00\x00\x00\x02name\x00\x05\x00\x00\x00Alice\x00\x00\xff\xff\xff'

@misc{vaitp:cve202421506,
  title        = {{Out-of-bounds Read vulnerability in pymongo bson module before 4.6.3.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21506},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21506/}}
}