currentOp leaks queryable encryption tokens in cursor.originatingCommand field

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Fixed
    • Priority: Major - P3
    • 9.1.0-rc0
    • Affects Version/s: None
    • Component/s: Queryable Encryption
    • None
    • Server Security
    • Minor Change
    • ALL
    • Hide

      Use the attached poc.py script.

      Show
      Use the attached poc.py script.
    • Server Security 2026-07-31, Server Security 2026-08-14
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      From zachary.espiritu@mongodb.com: A paginated Queryable Encryption (QE) read from an encrypted client can leak leaks its encrypted filter tokens to an unencrypted client that queries $currentOp with

      {idleCursors:true, allUsers: true}
      

      Per the redaction goals in SPM-3198, "the command will be redacted such that only the first element, $comment and $db exist.". We suppose redaction only got implemented for type: op outputs, and not type: idleCursor.

            Assignee:
            Sam Frank
            Reporter:
            Erwin Pe
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: