GHSA-mqvm-xxqr-vqw5: Duplicate geometry fields via unvalidated GeoJSON extra members
The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and the driver resolve different values for the same record. Affected records can also become unreadable through the driver, interrupting application code that reads them.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed when they place user-supplied field names into GeoJSON extra members. The risk arises if those names can collide with reserved GeoJSON member names.
What must an attacker be able to control?
An attacker needs the ability to influence field names written as GeoJSON extra members. Names that collide with reserved members, such as type or coordinates, can create duplicate geometry fields.
What is the practical impact of a malformed stored record?
The MongoDB server and the C# Driver can resolve different values for the same record. Affected records may also be unreadable through the driver, interrupting application code that reads them.
How can teams identify potentially affected data?
Review code paths that write user-controlled names into GeoJSON extra members, and inspect records produced through those paths for duplicate reserved geometry member names. Reserved-name collisions are the condition described as causing divergent handling and read failures.