Skip to main content

Deserialization of Untrusted Data

CVE-2022-48282

High
7.2/10

Summary

Under very specific circumstances (see NOTE), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This affects MongoDB.Driver and MongoDB.Bson versions prior to 2.19.0. NOTE: The application must be written in C#, taking arbitrary data from users, and serializing data using `_t` without any validation AND it must be running on a Windows host using the full .NET Framework, not .NET Core AND it must have domain model class with a property/field explicitly of the type `System.Object` or a collection of the type `System.Object` AND an attacker must have unrestricted insert access to target the database to add a `_t` discriminator.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-502 - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerabilities enable an attacker to replace or manipulate a serialized object, replacing it with malicious data. When the object is deserialized at the victim's end the malicious data is able to compromise the victim’s system. The exploit can be devastating, its impact may range from privilege escalation, broken access control, or denial of service attacks to allowing unauthorized access to the application's internal code and logic which can compromise the entire system.

References

Advisory Timeline

  • Published