Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-79069

command line censoring can't protect servers on Windows

    XMLWordPrintableJSON

Details

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor - P4 Minor - P4
    • None
    • None
    • None
    • Windows
    • Server Security
    • ALL

    Description

      The censorArgvArray in 

      https://github.com/mongodb/mongo/blob/4ca2f9fe5a11855510d0f69bc863f17c14580a5a/src/mongo/util/cmdline_utils/censor_cmdline.h#L44

      censorArgvArray(int argc, char** argv);

       

      is meant to overwrite argv to hide command-line secrets from `ps` or `/proc` traversal.

      But on Windows, the argv we give is not the real argvW. It's a copy, so modifying it has no effect.

      Windows processes have a special undocumented PEB block that may need to be modified to do the censoring properly.

      Attachments

        Activity

          People

            backlog-server-security Backlog - Security Team
            billy.donahue@mongodb.com Billy Donahue
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

            Dates

              Created:
              Updated: