Description

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permission to write to a sampled MongoDB collection can choose a name that closes the quoted identifier early, so that additional SQL text becomes part of the generated output. If an operator or automated tool later replays that generated statement against a SQL server, the additional text is executed with the privileges of that session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-28T20:19:56.030Z",
  "pubdate": "2026-08-28T20:19:56.030Z",
  "executiveSummary": "The MongoDB Connector for BI contains a SQL injection vulnerability resulting from improper neutralization of special elements used in an SQL command (CWE-89).\nThe vulnerability occurs because MongoDB object names—specifically collection, field, and index names—are directly embedded into the quoted identifiers of DDL (Data Definition Language) text within SHOW CREATE statements without sufficient sanitization or escaping of the identifier delimiter.\nThis flaw allows a malicious actor with write access to a sampled MongoDB collection to craft object names that break out of the intended identifier context.\nBy terminating the quoted identifier prematurely, an attacker can inject arbitrary SQL commands into the generated output.\nIf an operator or an automated management tool subsequently executes this poisoned DDL on a downstream SQL server, the injected SQL code is executed with the privileges of the executing session.\nThe impact includes potential unauthorized data access, modification, or escalation of privileges on the connected SQL database, depending on the permissions of the user account used to replay the generated statements.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the DDL generation logic within the MongoDB Connector for BI. When the connector generates SHOW CREATE statements to represent the schema of a MongoDB collection, it includes the names of various MongoDB objects—such as collection names, field names, and index names—directly into the resulting SQL text.\nThe generator fails to implement character escaping or delimiter sanitization for these object names. In SQL, identifiers are typically enclosed in double quotes (e.g., \"identifier\"). If an attacker creates a MongoDB collection or field with a name containing the double-quote character, they can effectively terminate the quoted identifier string prematurely.\nFor example, if a user creates a collection named 'my_collection\" OR 1=1; --', the resulting SHOW CREATE statement would incorporate this input such that the closing quote of the identifier is provided by the attacker's input, causing the remainder of their input to be parsed as valid, executable SQL commands rather than as a string literal.\nThe attack flow follows a specific progression: First, an authenticated attacker with write permissions to a MongoDB collection creates or renames a collection or field to include the malicious payload (the closing delimiter and subsequent SQL injection commands). Second, the attacker triggers or waits for the generation of a SHOW CREATE statement via the MongoDB Connector for BI. Third, the connector generates the malformed SQL string containing the payload. Finally, an operator or automated database management system executes the poisoned DDL statement against the target SQL server.\nBecause the execution happens on the target SQL server, the payload runs with the privileges of the database user configured for the connector or the session running the tool. The attacker does not need direct access to the SQL server; they only need the ability to influence the metadata of the MongoDB collection and ensure the generated output is eventually processed by an administrator or automated system.\nThe vulnerability is primarily located in the DDL formatting logic of the MongoDB Connector for BI. It represents a significant risk where MongoDB serves as a data source for SQL-based analytics or integration platforms, as the trust boundary between the MongoDB schema definitions and the SQL generation logic is effectively bypassed."
}