CyberRota Analysis
AI-GeneratedThe vulnerability in libmongoc's SCRAM authentication allows an attacker in a man-in-the-middle position to exploit nonce mismatches during the authentication handshake, potentially capturing the client proof for offline password cracking. While the impact is considered low, organizations using libmongoc without TLS should prioritize remediation to prevent unauthorized access. This is particularly relevant for environments where secure communications are not enforced, as the flaw could lead to compromised credentials.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
Related CVEs
Other vulnerabilities affecting the same vendor(s)