PT-2023-15661 · Mongodb · Mongodb .Net/C# Driver

Jonathan Birch

·

Published

2023-02-21

·

Updated

2023-08-12

·

CVE-2022-48282

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions MongoDB .NET/C# Driver versions prior to and including v2.18.0
Description Under very specific circumstances, a privileged user is able to cause arbitrary code to be executed, which may cause further disruption to services. This issue is specific to applications written in C#. The vulnerability requires certain conditions to be met, including the application being written in C#, running on a Windows host using the full .NET Framework, having a domain model class with a property or field of type System.Object, and the malicious attacker having unrestricted insert access to the target database.
Recommendations For MongoDB .NET/C# Driver versions prior to and including v2.18.0, update to a version later than v2.18.0 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable application and ensuring that all user input is properly validated to minimize the risk of exploitation. Avoid using the System.Object type in domain model classes and ensure that all data serialization is properly validated. Restrict insert access to the target database to prevent malicious attackers from adding a t discriminator.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-48282
GHSA-7J9M-J397-G4WX

Affected Products

Mongodb .Net/C# Driver