Description

In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CREATE statements without complete escaping of backslash characters. A user with permission to modify a collection's schema validator, in deployments configured to build their SQL schema from those validators, can cause additional SQL text to be embedded in that generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.2",
  "pubDate": "2026-08-28T20:19:55.400Z",
  "pubdate": "2026-08-28T20:19:55.400Z",
  "executiveSummary": "The MongoDB Connector for BI contains a vulnerability stemming from improper input sanitization of JSON schema validator metadata.\nThis flaw allows for SQL injection when the connector generates DDL statements via SHOW CREATE commands.\nBy manipulating the description text within a collection's JSON schema validator, an authenticated user with schema modification permissions can inject arbitrary SQL commands into the generated output.\nThe primary risk involves the unauthorized execution of SQL queries on the downstream SQL server when the generated DDL is replayed by administrators or automated processes.\nThis vulnerability highlights a critical breakdown in input validation where untrusted metadata is treated as trusted SQL syntax, potentially leading to unauthorized data access, privilege escalation, or database manipulation depending on the privileges of the executing session.\nSuccessful exploitation requires the attacker to have sufficient permissions to alter collection schema validators within the MongoDB instance.",
  "technicalDetails": "The vulnerability is rooted in the MongoDB Connector for BI's DDL generation logic, specifically how it processes and embeds JSON schema validator description fields into the comment blocks of generated SQL statements.\nWhen a user executes a SHOW CREATE statement, the connector constructs the DDL response by pulling validator metadata. The implementation fails to properly sanitize or escape backslash characters within the description field before incorporating this string into the SQL response.\nBecause the output is formatted as a comment in the resulting DDL, an attacker can utilize escape sequences to break out of the comment context or manipulate the surrounding SQL structure if the downstream parser processes the comment delimiter improperly or if the injected text effectively terminates the comment block.\nThe attack flow proceeds as follows: First, an attacker with authorization to update a collection's JSON schema validator modifies the 'description' field of a validator to include malicious SQL syntax, carefully crafted with backslash escape characters to bypass rudimentary filters. Second, the attacker or an automated tool triggers the MongoDB Connector for BI to generate a DDL statement for the affected collection (e.g., executing a SHOW CREATE TABLE command). Third, the connector retrieves the compromised validator description and embeds it directly into the generated SQL output without adequate escaping. Finally, when this DDL statement is executed against the target SQL server by an operator or automated system, the injected malicious payload is executed with the privileges of that SQL session.\nThe impact is significant: the injection allows for the execution of arbitrary SQL commands, potentially enabling attackers to perform unauthorized data extraction, modify database schema objects, or execute administrative commands, provided the user account replaying the script holds sufficient permissions on the destination SQL database. This represents a classic secondary SQL injection vector where the vulnerability lies not in the storage of the malicious input, but in the subsequent consumption and execution of the improperly formatted output by a trusted automated pipeline."
}