GHSA-65fr-j4p9-vc33: High severity composer/mongodb/mongodb vulnerability
Impact Passing untrusted input as part of a database or collection name may result in targeting a different database or collection than specified.
Patches Fixed in PHP library 1.21.4 and 2.4.1.
Workarounds Validate database and collection names prior to passing into APIs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mongodb/mongodbto a version that resolves this vulnerability.Fixed in 2.4.1 - Upgrade
Upgrade
composer/mongodb/mongodbto a version that resolves this vulnerability.Fixed in 1.21.4 - Upgrade
Upgrade
PHP libraryto a version that resolves this vulnerability.Fixed in 1.21.4 - Upgrade
Upgrade
PHP libraryto a version that resolves this vulnerability.Fixed in 2.4.1 - Configuration
Validate database and collection names before passing untrusted input into the PHP library APIs to prevent targeting a different database or collection than intended.
Application code using the PHP library Database and collection name validation = Validate database and collection names prior to passing into APIs
Event History
Frequently Asked Questions
Which versions contain the fix?
The issue is fixed in PHP library versions 1.21.4 and 2.4.1.
What access does an attacker need to exploit this?
An attacker needs the ability to provide untrusted input that is used as part of a database or collection name passed to the library's APIs. The supplied data may cause operations to target a different database or collection than intended.
What can be done if updating is not immediately possible?
Validate database and collection names before passing them to the affected APIs. Do not construct these names directly from untrusted input without validation.