Title: MongoDB MONGOSH Password Exposure Vulnerability  
Product: MongoDB database  
Tool: mongosh  
Affected Version(s): 2.0.1 , 2.1.1,2.1.4,2.1.5  
Tested Version(s): 2.0.1 , 2.1.1,2.1.4,2.1.5  
Risk Level: Low  
Author of Advisory: Emad Al-Mousa  
Vulnerability Details:  
Vulnerability in MongoDB database system "mongosh" which is a JavaScript and Node.js REPL environment for interacting with MongoDB deployments in Atlas , locally, or on another remote host. So, its basically a command line utility to run database commands and java scripts against back-end MongoDB database system.  
MONGOSH has two vulnerbailites where passwords can be exposed and leaked in which an attacker to the operating system can weaponize for unauthorized access to the MongoDB database system.  
Proof of Concept (PoC):  
Vulnerability No1. : passwordPrompt() showing password displayed in clear text  
per documentation:  
The password should not be displayed, however I found out that it appears clearly in the prompt !  
The password function passwordPrompt() was tested and used in conjunction with db.createUser, db.changeUserPassword, db.auth commands and all of them were allowing clear text password to appear.  
admin> use admin  
already on db admin  
admin> db.createUser({user:"mongo2", pwd: passwordPrompt(), roles:["root"]})  
Enter password  
*****{ ok: 1 }  
Vulnerability No2. : Password is exposed in mongosh_repl_history file with db.auth command  
Mongosh was tested with both “remove”& “remove-redact” modes  
config.set (redactHistory, “remove-redact”)  
config.set (‘redactHistory’, “remove”)  
In Linux Red Hat Environment the file: $MONGOHOME/.mongodb/mongosh/mongosh_repl_history  
Contains the password in clear text for historical commands run for authentication db.auth() and db.createUser , per documentation: the logs should omit the credentials but this didn’t happen !  
In windows operating system environment the file: C:\Users\windows_profile_user\AppData\Roaming\mongodb\mongosh  
Commands running for database creation db.createUser and db.auth() are logging the username, password explicitly as shown below:  
cat mongosh_repl_history  
use admin  
db.createUser({user:"mongo2", pwd: passwordPrompt(), roles:["root"]})