An authenticated user can exploit a SQL injection flaw in the MongoDB BI Connector to execute arbitrary commands, posing a high risk of unauthorized data access and manipulation.

This vulnerability occurs because the connector fails to properly escape identifier delimiters when generating DDL text. An authenticated user with write access to a sampled collection can inject malicious SQL code that is executed when the system processes the generated output.

Successful exploitation allows an attacker to execute arbitrary SQL commands with the privileges of the database session. Given the CVSS score of 8.0, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification, or potential privilege escalation within the backend SQL environment.

Immediate Action: Update to MongoDB BI Connector version 2.14.31 or later to implement proper identifier escaping.

Proactive Monitoring: Monitor database access logs for unexpected SQL queries or structural changes initiated by service accounts.

Compensating Controls: Restrict write permissions on MongoDB collections to trusted users only and implement strict validation for collection and index naming conventions.

Public Exploit Available: No

This vulnerability presents a significant risk to data integrity and system security. Organizations should prioritize upgrading to version 2.14.31 immediately to close the injection vector and protect against potential unauthorized command execution.