CVE-2021-20327: 
JavaScript vulnerability analysis and mitigation

A specific version of the Node.js mongodb-client-encryption module (version 1.2.0) was identified with a security vulnerability related to improper certificate validation. The vulnerability was discovered during internal testing and was available from January 29, 2021, until it was deprecated in the NPM Registry on February 4, 2021 (NVD).

The vulnerability stems from incorrect validation of the KMS server's certificate in the mongodb-client-encryption module. The issue is tracked as CWE-295 (Improper Certificate Validation) with a CVSS v3.1 base score of 6.8 (MEDIUM) and vector string CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD, MongoDB JIRA).

When exploited, this vulnerability could allow an attacker with a privileged network position to perform an active MITM (Man-in-the-Middle) attack, potentially intercepting traffic between the Node.js driver and the KMS service. This would effectively render the client-side field level encryption (CSFLE) ineffective (NVD).

The vulnerability requires an attacker to have a privileged network position to perform an active MITM attack. However, applications residing inside AWS, GCP, and Azure network fabrics are protected due to existing compensating controls in these environments. Additionally, the vulnerability only affects workloads that use Field Level Encryption (NVD).

The vulnerability was addressed with the release of version 1.2.1 of the mongodb-client-encryption module. Users of version 1.2.0 should upgrade to the fixed version. It's worth noting that this issue does not impact driver workloads that don't use Field Level Encryption (MongoDB JIRA).