MongoDB 7.0.x < 7.0.35 / 8.0.x < 8.0.24 / 8.2.x < 8.2.10 / 8.3.x < 8.3.3 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320792);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/15");

  script_cve_id(
    "CVE-2026-9740",
    "CVE-2026-9746",
    "CVE-2026-9748",
    "CVE-2026-9749",
    "CVE-2026-9753"
  );
  script_xref(name:"IAVA", value:"2026-A-0590");

  script_name(english:"MongoDB 7.0.x < 7.0.35 / 8.0.x < 8.0.24 / 8.2.x < 8.2.10 / 8.3.x < 8.3.3 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.35, 8.0.x prior to 8.0.24, 8.2.x prior to
8.2.10, or 8.3.x prior to 8.3.3. It is, therefore, affected by multiple vulnerabilities:

  - The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff containing a
    malformed binary diff to return memory out-of-bounds or crash the server. $_internalApplyOplogUpdate can be
    executed by any authenticated user with access to the aggregate command. (CVE-2026-9753)

  - A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod
    process by sending a specially crafted message. The BSON validator's handling of certain nested binary data
    structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets
    internal depth tracking. (CVE-2026-9740)

  - When using $changestreams and $_requestReshardingResumeToken with the exchange option the server hits an
    invariant which causes the server to crash. There are no special privileges needed. The user must be logged
    in to issue the statement. (CVE-2026-9746)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-123951");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-124031");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-124190");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-124959");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-125063");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MongoDB version 7.0.35, 8.0.24, 8.2.10, or 8.3.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9753");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-9740");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/12");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mongodb:mongodb");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mongodb_win_installed.nbin", "mongodb_nix_installed.nbin", "mongodb_macos_installed.nbin", "mongodb_detect.nasl");
  script_require_keys("installed_sw/MongoDB");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'MongoDB', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {'min_version':'7.0.0', 'fixed_version':'7.0.35'},
        {'min_version':'8.0.0', 'fixed_version':'8.0.24'},
        {'min_version':'8.2.0', 'fixed_version':'8.2.10'},
        {'min_version':'8.3.0', 'fixed_version':'8.3.3'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, check_backporting:TRUE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);