Horizon Alert
Summary of the vulnerability and why it matters
An administrator with webhook configuration access can execute arbitrary commands by inputting malicious FreeMarker syntax into webhooks. This allows for significant compromise if the attacker can trigger the webhook.
- Unauthorized command execution is possible.
- Existing administrative access is required.
- Affects MongoDB Ops Manager versions.
Attack Path
How an attacker could exploit the issue
An attacker who already has administrative access to MongoDB Ops Manager can exploit this by crafting a malicious webhook. When this webhook is triggered, the FreeMarker template syntax within it will execute arbitrary commands on the server.
- Needs admin access.
- Targets webhook configuration.
- Triggers malicious template.
Live Threat
Current exploitation, exposure, and threat context
Attackers are unlikely to weaponize this vulnerability. MongoDB Ops Manager is an internal administrative tool, not exposed to the public internet, and access is restricted to authorized personnel. This internal nature significantly limits the attack surface for external threat actors.
- Internal administrative application.
- Not publicly accessible.
- Access restricted by network controls.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize the configuration and triggering of webhooks in MongoDB Ops Manager, as an administrative user can execute arbitrary commands by exploiting a FreeMarker template injection vulnerability. This critical vulnerability impacts versions 7.0 and prior versions of 8.0.
- Update to MongoDB Ops Manager 8.0.23.
- If immediate patching is not possible, restrict webhook creation and execution.
- Monitor logs for suspicious webhook activity.
