Description

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query is interpreted by the browser when an operator later generates and opens the report, which may disclose other users' logged query text and user names to an external party or present misleading content to the operator. Generating a report over logs containing the affected entries and opening that report in a browser is required.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-28T20:19:55.263Z",
  "pubdate": "2026-08-28T20:19:55.263Z",
  "executiveSummary": "The MongoSQL Transition Readiness Tool is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability originating from improper input sanitization of BI Connector log files.\nThe vulnerability allows an authenticated attacker capable of issuing queries through the BI Connector to inject malicious markup, including scripts, into log entries.\nWhen an operator generates an HTML report containing these logs and renders it in a web browser, the malicious script executes within the context of the operator's session.\nSuccessful exploitation can lead to unauthorized disclosure of sensitive user information, such as other users' query history and account identifiers, or the presentation of deceptive content to administrative personnel.\nThe risk is categorized as significant due to the potential for session compromise or data exfiltration. Exploitation requires an attacker to have legitimate BI Connector query access and relies on an administrative operator to perform the report generation and viewing process.",
  "technicalDetails": "The root cause of this vulnerability is a failure to perform context-aware output encoding when the MongoSQL Transition Readiness Tool parses BI Connector log files to generate HTML reports. The application treats raw input strings—specifically the query text and user names derived from logs—as trusted data, directly injecting them into the DOM without sanitization.\nThe attack flow begins with an authenticated user crafting a malicious query string containing HTML or JavaScript payloads. Because the BI Connector logs these queries, the malicious payload is persisted into the log file. The vulnerability is effectively a multi-stage attack: the initial injection occurs at the log-writing stage, while the payload execution occurs when the report generation utility reads the poisoned log data.\nOnce the payload is embedded in the log, it remains dormant until the MongoSQL Transition Readiness Tool processes the file for report generation. The tool generates an HTML output file where the injected content is placed verbatim. When an operator opens this report in a web browser, the browser interprets the injected tags, causing the JavaScript payload to execute within the security context of the report file origin.\nGiven that the attacker is able to inject arbitrary markup, the impact extends beyond simple display manipulation. An attacker could employ Cross-Site Scripting payloads designed to exfiltrate session cookies, perform unauthorized actions on behalf of the operator if the browser environment permits, or harvest data displayed in the report, such as the activity logs of other users. Because the BI Connector handles structured data, the potential for leaking query parameters that may contain sensitive database information is elevated.\nThe vulnerability is dependent on the attacker having sufficient privileges to issue queries that the BI Connector will subsequently log. There is no requirement for external network exposure, as the threat is primarily internal, originating from authorized users. The integrity of the report generation process is compromised, rendering the generated HTML reports a vectors for administrative exploitation."
}