Description
MongoDB Ops Manager Diagnostics Archive does not redact SAML SSL Pem Key File Password field (mms.saml.ssl.PEMKeyFilePassword) within app settings. Archives do not include the PEM files themselves. This module extracts that unredacted password and stores the diagnostic archive for additional manual review.
This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12.
API credentials with the role of GLOBAL_MONITORING_ADMIN or GLOBAL_OWNER are required.
Successfully tested against MongoDB Ops Manager v6.0.11.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/gather/mongodb/ops_manager_diagnostic_archive_infomsf undefined(ops_manager_diagnostic_archive_info) > show actions ...actions...msf undefined(ops_manager_diagnostic_archive_info) > set ACTION < action-name >msf undefined(ops_manager_diagnostic_archive_info) > show options ...show and set options...msf undefined(ops_manager_diagnostic_archive_info) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub