AVID-2026-R1172

Description

Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution (CVE-2022-48282)

Details

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0

Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND

Application must be running on a Windows host using the full .NET Framework, not .NET Core AND
Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND
Malicious attacker must have unrestricted insert access to target database to add a _t discriminator.“Following configuration must be true for the vulnerability to be applicable

Reason for inclusion in AVID: The CVE describes a remote code execution vulnerability in the MongoDB .NET/C# Driver via deserialization. This is a software vulnerability in a library that can be used in applications, including AI/data-processing pipelines, making it relevant to the supply chain of general-purpose AI systems. The vulnerability affects software components (drivers) used to build/run AI systems and data workflows. There is clear evidence of vulnerability type (RCE), affected versions, and conditions, satisfying the criteria for a security/safety vulnerability with sufficient evidence. Therefore it should be kept for AVID curation as a vulnerability in the AI software supply chain.

References

Affected or Relevant Artifacts

Developer: MongoDB Inc
Deployer: MongoDB Inc
Artifact Details:

Type	Name
System	MongoDB .NET/C# Driver

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score	6.6
Base Severity	🟠 Medium
Attack Vector	NETWORK
Attack Complexity	🔴 High
Privileges Required	🔴 High
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-502	CWE-502 Deserialization of Untrusted Data

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-02-21
Version: 0.3.3
AVID Entry