Risk Assessment, Remediation, and Mitigation Plan for Netskope Cloud Exchange Deployments

Vulnerability Description and Impact

MongoDB has identified a security vulnerability related to incorrect length handling in Zlib-compressed protocol headers. Under specific conditions, this issue may cause the MongoDB server to read uninitialized heap memory.

The vulnerability can be triggered by an unauthenticated client, but requires access to the internal network. Public internet exploitation is not possible under default configurations.

The vulnerability affects the following MongoDB versions:

• MongoDB Server 7.0 prior to 7.0.28
• MongoDB Server 8.0 prior to 8.0.17
• MongoDB Server 8.2 prior to 8.2.3
• MongoDB Server 6.0 prior to 6.0.27
• MongoDB Server 5.0 prior to 5.0.32
• MongoDB Server 4.4 prior to 4.4.30
• MongoDB Server 4.2, 4.0, and 3.6 (supported versions)

Standalone Deployment

• Definition:
  • MongoDB operates within a Docker internal network.
  • The MongoDB service port is not exposed to the VM or external networks.
• Exploit method requirement:
  • Exploitation is possible only if an attacker gains privileged access to the Docker network within the VM.

High Availability (HA) Deployment

• Definition:
  • Cloud-based HA deployments use a private IP network, as recommended.
  • On-premises HA deployments also operate exclusively on a private network.
• Exploit method requirement:
  • Successful exploitation would require an attacker to obtain access to the private network used for MongoDB communication.

Deployment architecture and network isolation controls in Cloud Exchange considerably reduce the overall risk. The MongoDB vulnerability does not introduce direct exposure to public networks, and requires prior network access to exploit.

Cloud Exchange will upgrade MongoDB to version 8.0.17, which includes the security fix.

For Cloud Exchange versions 5.x through 6.0.0, Netskope teams recommend several options to avoid this vulnerability in a docker network in Standalone, and in a private network in HA.

Standalone Deployment for v5.0.1 (deprecated), v5.1.0, v5.1.1, v5.1.2, v6.0.0, v6.0.1 and v6.1.0

1. Go to the Cloud Exchange installation directory (For CE as a VM, go to /opt/cloudexchange/cloudexchange)
2. Stop Cloud Exchange using this command:

   sudo ./stop

3. Update the docker-compose.yml (Ubuntu and Docker based deployment) or podman-compose.yml (RHEL and Podman based deployment) file with these instructions in mongodb-primary sections of the yml file, and then save the file.

v6.0.0 Standalone

Before the yml file v6.0.0 update

Add this argument after the mongod keyword in the entrypoint section of the mongodb-primary.

--networkMessageCompressors snappy,zstd

After the yml file v6.0.0 update

v5.1.2, v5.1.1 Standalone

Before the yml file v5.1.2, v5.1.1 update

Add this argument after the mongod keyword in entrypoint section of the mongodb-primary.

--networkMessageCompressors snappy,zstd

After the yml file v5.1.2, v5.1.1 update

v5.0.1 (deprecated), v5.1.0 Standalone

Before the yml file v5.0.1, v5.1.0 update

Add this argument after the mongod keyword in entrypoint section of the mongodb-primary.

--networkMessageCompressors snappy,zstd

After the yml file v5.0.1, v5.1.0 update

Start Cloud Exchange using this command:

sudo ./start

HA Deployment for v5.0.1 (deprecated), v5.1.0, v5.1.1, v5.1.2, v6.0.0, v6.0.1 and v6.1.0

1. Go to the Cloud Exchange installation directory of the secondary nodes (For CE as a VM, go to /opt/cloudexchange/cloudexchange).
2. Stop Cloud Exchange using this command for all secondary nodes one by one:

   sudo ./stop

3. Go to the Cloud Exchange directory of the primary node (For CE as a VM, go to /opt/cloudexchange/cloudexchange).
4. Stop Cloud Exchange using this command for the primary node.

   sudo ./stop

5. Update the docker-compose-ha.yml (Ubuntu and Docker based deployment) or podman-compose-ha.yml (RHEL and Podman based deployment) file with these instructions in mongodb-primary sections of the yml file, and save the file in all HA nodes one by one.

v6.0.0 HA

Before the yml file v6.0.0 update

Add this argument after the mongod keyword in the entrypoint section of the mongodb-primary.

--networkMessageCompressors snappy,zstd

After the yml file v6.0.0 update

v5.1.2, v5.1.1 HA

Before the yml file v5.1.1, v5.1.2 update

Add this argument after the mongod keyword in the command section of the mongodb-primary.

--networkMessageCompressors snappy,zstd

After the yml file v5.1.1, v5.1.2 update

v5.0.1 (deprecated), v5.1.0 HA

Before the yml file v5.0.1, v5.1.0 update

Add this argument after the mongod keyword in the command section of the mongodb-primary.

--networkMessageCompressors snappy,zstd

After the yml file v5.0.1, v5.1.0 update

1. Start the Cloud Exchange primary node using this command:

   sudo ./start

2. Start the secondary Cloud Exchange nodes using this command:

   sudo ./start