GHSA-2xqr-fxmx-2cmf: NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
Affected Software
Event History
Frequently Asked Questions
Which application paths should be reviewed first?
Review LINQ queries and updates where application-user input can become a dictionary key, field name, or array-filter identifier. Those are the positions identified as allowing an attacker to alter the field path sent to MongoDB.
What level of attacker access is indicated?
The supplied severity vector indicates network reachability, low privileges required, and no user interaction required. In practical terms, the relevant attacker is an application user able to supply input that reaches the affected LINQ field-path positions.
How can teams determine whether they may already be exposed?
Trace externally controlled values through LINQ query and update construction, specifically checking whether they are used as dictionary keys, field names, or array-filter identifiers. Exposure depends on user input reaching those positions rather than merely using the driver.
Is a specific remediation version identified in the provided data?
The references include the MongoDB C# Driver v3.13.0 release page, but the provided data does not explicitly state affected version ranges or confirm a fixed version. Use the referenced release and advisory materials to validate the applicable upgrade path.