@GossiTheDog They were just doing Advent of Vulns.

@GossiTheDog I am having a bit of trouble getting worked up about this.
The bug went public six days before Christmas. This means, frankly, that the folks who get paid to be bad actors, of which there are rather many nowadays, have had six days to figure out how to exploit it. I'm sure several of them had already figured it out before the Eclipse dude dropped the exploit.
By making the urgency of patching this issue clear, he has arguably done a public service.

@GossiTheDog every version going back a decade? Thank goodness we're ok then, ours is older 😎

@GossiTheDog who the fuck exposes a DB directly to the internet?

@GossiTheDog .oO( Surely nobody exposes mongodb towards the inter-| OMGWTFBBQsrsly?

The exploit is real and works, you can just run it and target specific offsets and/or keep running it until you get AWS secrets and such.

@GossiTheDog crappy timing but looks like it was a bit earlier than that. https://jira.mongodb.org/browse/SERVER-115508

@GossiTheDog
At least they have the decency to wait till Christmas unlike log4j

@GossiTheDog
Me, unemployed right now: 😎

@GossiTheDog it really is the best time. If I had the power to discover and release stuff like this I would do it always during these times of the year. Such a power move

@GossiTheDog whyyyyyy

@GossiTheDog oh for fuck's sake, what an asshole time to drop that one