BSON Deserialization Type Allow-List Bypass in MongoDB C# Driver

Executive Summary

This vulnerability is a type allow-list bypass in the BSON serialization library of the MongoDB C# Driver. It allows an unauthorized party to bypass type-restriction checks when polymorphic data is deserialized into loosely typed members. This can lead to the application instantiating unintended .NET types and populating them with attacker-controlled values.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can result in arbitrary code execution in the context of the application. This can lead to loss of confidentiality, integrity, and availability of the affected system. Attackers only need the ability to introduce data that the application reads.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to loss of confidentiality, integrity, and availability of data, which may violate compliance requirements under GDPR (e.g., unauthorized data access or processing) and HIPAA (e.g., unauthorized disclosure of protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Update the MongoDB C# Driver to the latest version that patches this vulnerability. Review applications using the driver to ensure polymorphic data deserialization is restricted to intended types. Monitor for unusual .NET type instantiations or unauthorized code execution.

Useful 0 Not Useful 0