MongoDB 7.0.x < 7.0.35 / 8.0.x < 8.0.24 / 8.2.x < 8.2.10 / 8.3.x < 8.3.3 / 9.0.0-rc0 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320791);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/15");

  script_cve_id(
    "CVE-2026-9741",
    "CVE-2026-9747",
    "CVE-2026-9750",
    "CVE-2026-9751",
    "CVE-2026-9752"
  );
  script_xref(name:"IAVA", value:"2026-A-0590");

  script_name(english:"MongoDB 7.0.x < 7.0.35 / 8.0.x < 8.0.24 / 8.2.x < 8.2.10 / 8.3.x < 8.3.3 / 9.0.0-rc0 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.35, 8.0.x prior to 8.0.24, 8.2.x prior to
8.2.10, or 8.3.x prior to 8.3.3. It is, therefore, affected by multiple vulnerabilities:

  - A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or
    Client-Side Field Level Encryption (CSFLE) results in literal values for encrypted fields within the
    $vectorSearch stage filter expressions to be sent to the server as plaintext instead of ciphertext.
    (CVE-2026-9741)

  - Adding fromRouter:true and runtimeConstants.userRoles could cause aggregations to crash mongodb server.
    (CVE-2026-9747)

  - An authenticated user can cause a MongoDB server to crash or return incorrect results by creating documents
    that interfere with internal metadata processing during query execution. This stems from insufficient
    separation between user-controlled document fields and internal metadata in certain execution paths.
    (CVE-2026-9750)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-123370");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-123440");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-123507");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-123633");
  script_set_attribute(attribute:"see_also", value:"https://jira.mongodb.org/browse/SERVER-123918");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MongoDB version 7.0.35, 8.0.24, 8.2.10, 8.3.3, 9.0.0-rc0, or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9741");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-9752");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/12");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mongodb:mongodb");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mongodb_win_installed.nbin", "mongodb_nix_installed.nbin", "mongodb_macos_installed.nbin", "mongodb_detect.nasl");
  script_require_keys("installed_sw/MongoDB");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'MongoDB', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {'min_version':'7.0.0', 'fixed_version':'7.0.35'},
        {'min_version':'8.0.0', 'fixed_version':'8.0.24'},
        {'min_version':'8.2.0', 'fixed_version':'8.2.10'},
        {'min_version':'8.3.0', 'fixed_version':'8.3.3', 'fixed_display':'8.3.3 / 9.0.0-rc0'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, check_backporting:TRUE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);