{"record":{"id":"e181482d57721549","repo":"shadow1ng/fscan","slug":"invalid-scram-iteration-count","errorCode":null,"errorMessage":"invalid SCRAM iteration count","messagePattern":"invalid SCRAM iteration count","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mongodb.go","lineNumber":519,"sourceCode":"func buildMongoSCRAMClientFinal(username, password, clientFirstBare, serverFirst string) (string, error) {\n\tattrs := parseSCRAMAttributes(serverFirst)\n\tserverNonce := attrs[\"r\"]\n\tsaltB64 := attrs[\"s\"]\n\titerText := attrs[\"i\"]\n\tif serverNonce == \"\" || saltB64 == \"\" || iterText == \"\" {\n\t\treturn \"\", fmt.Errorf(\"invalid SCRAM server-first payload\")\n\t}\n\tclientNonce := scramAttr(clientFirstBare, \"r\")\n\tif clientNonce == \"\" || !strings.HasPrefix(serverNonce, clientNonce) {\n\t\treturn \"\", fmt.Errorf(\"invalid SCRAM nonce\")\n\t}\n\tsalt, err := base64.StdEncoding.DecodeString(saltB64)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid SCRAM salt: %w\", err)\n\t}\n\titerations, err := strconv.Atoi(iterText)\n\tif err != nil || iterations <= 0 {\n\t\treturn \"\", fmt.Errorf(\"invalid SCRAM iteration count\")\n\t}\n\n\tclientFinalWithoutProof := \"c=biws,r=\" + serverNonce\n\tauthMessage := clientFirstBare + \",\" + serverFirst + \",\" + clientFinalWithoutProof\n\tdigest := md5.Sum([]byte(username + \":mongo:\" + password))\n\tsaltedPassword := pbkdf2.Key([]byte(fmt.Sprintf(\"%x\", digest)), salt, iterations, sha1.Size, sha1.New)\n\tclientKey := mongoHMAC(saltedPassword, []byte(\"Client Key\"))\n\tstoredKey := sha1.Sum(clientKey)\n\tclientSignature := mongoHMAC(storedKey[:], []byte(authMessage))\n\tproof := make([]byte, len(clientKey))\n\tfor i := range clientKey {\n\t\tproof[i] = clientKey[i] ^ clientSignature[i]\n\t}\n\treturn clientFinalWithoutProof + \",p=\" + base64.StdEncoding.EncodeToString(proof), nil\n}\n\nfunc parseSCRAMAttributes(payload string) map[string]string {\n\tattrs := make(map[string]string)","sourceCodeStart":501,"sourceCodeEnd":537,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mongodb.go#L501-L537","documentation":"The i= attribute of the SCRAM server-first message is the PBKDF2 iteration count. If it is not a positive integer (strconv.Atoi fails or it is <= 0), the plugin rejects it as an invalid iteration count.","triggerScenarios":"iterText is empty at this point only if attributes were partially present, or contains non-numeric text (e.g. '10000x', negative, or 0) — usually from a malformed or hostile server-first payload.","commonSituations":"Honeypot/fake MongoDB returning junk i= values; corrupted payload; extremely old or custom servers with non-numeric iteration fields.","solutions":["Inspect the i= value in the server-first payload for non-numeric content","Verify the server is a standard mongod emitting a positive integer iteration count","Consider clamping/validating the iteration count range before use to reject absurd values","Retry against a known-good MongoDB instance to isolate whether the target is misbehaving"],"exampleFix":"// before\niterations, err := strconv.Atoi(iterText)\nif err != nil || iterations <= 0 {\n    return \"\", fmt.Errorf(\"invalid SCRAM iteration count\")\n}\n// after\niterations, err := strconv.Atoi(iterText)\nif err != nil || iterations <= 0 || iterations > 1<<24 {\n    return \"\", fmt.Errorf(\"invalid SCRAM iteration count: %q\", iterText)\n}","handlingStrategy":"validation","validationCode":"it, err := strconv.Atoi(scramAttr(serverFirst, \"i\"))\nif err != nil || it <= 0 || it > 1<<24 {\n    return fmt.Errorf(\"iteration count out of accepted range\")\n}","typeGuard":"func isValidIterationCount(s string) bool {\n    n, err := strconv.Atoi(s)\n    return err == nil && n > 0 && n <= 1<<24\n}","tryCatchPattern":"if _, err := buildMongoSCRAMClientFinal(u, p, cfb, serverFirst); err != nil && strings.Contains(err.Error(), \"iteration count\") {\n    log.Warnf(\"target reported unusable iteration count: %v\", err)\n    return\n}","preventionTips":["Bound-check i= against sane SCRAM ranges (1k–10M)","Fingerprint the server before trusting its SCRAM parameters","Log the raw i= value on failure to identify hostile targets"],"tags":["mongodb","scram","pbkdf2","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}