CyberRota Analysis
AI-GeneratedMongoDB is vulnerable due to insufficient validation of shard key values during document insertion, allowing authenticated users to exploit this flaw by inserting specially crafted objects. This can lead to incorrect post-image documents being sent to change stream consumers or trigger non-resumable fatal errors during processing. Organizations using MongoDB, particularly those relying on change streams for real-time data processing, should prioritize addressing this vulnerability to mitigate potential data integrity issues.
Original NVD Description
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.
Related CVEs
Other vulnerabilities affecting the same vendor(s)