GHSA-68cj-624m-mxj3: NoSQL operator injection via unvalidated replacement document in findOneAndReplace
The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.
Affected Software
Event History
Frequently Asked Questions
What application pattern makes this issue exploitable?
An application is exposed if it builds the replacement document passed to FindOneAndReplace from user-supplied field names without rejecting top-level names that begin with a dollar sign. A low-privileged attacker able to supply those field names could cause MongoDB update operators to be applied.
How broad can the resulting modification be?
The effect is limited to the document selected by the application's own FindOneAndReplace filter. The issue does not let the attacker select arbitrary documents beyond what that filter matches, but it can alter the matched document in unintended ways.
What can be done if updating the driver is not immediately possible?
Reject or sanitize user-controlled top-level replacement-document field names beginning with a dollar sign before calling FindOneAndReplace. Review every use of that method where replacement document keys can originate from request data or other untrusted input.