A high-severity vulnerability in the MongoDB C++ Driver allows an authenticated user to perform unauthorized file access or deletion within GridFS, posing a significant risk to data integrity.

This vulnerability, categorized as CWE-943, involves improper neutralization of special elements in data query logic. An authenticated user who can influence the structured file identifier passed to the GridFS component can force the driver to interpret the input as a query condition, leading to unauthorized retrieval or deletion of file chunks.

The exploitation of this flaw could result in the total loss of availability for stored files within an affected bucket, as an attacker can trigger the deletion of all file chunks. Furthermore, the ability to read arbitrary file content beyond the intended target leads to significant data exposure. With a CVSS score of 8.3, this high-severity vulnerability necessitates immediate attention to prevent operational disruption and data privacy breaches.

Immediate Action: Update the MongoDB C++ Driver to version 4.5.3 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Review application access logs for unusual patterns in GridFS file operations, particularly those involving unexpected characters or unexpected query structures in file identifier parameters.

Compensating Controls: Implement strict input validation and sanitization for all user-supplied identifiers before they are passed to the GridFS component to prevent malicious query injection.

Public Exploit Available: No (exploit_available: false)

Given the potential for permanent data loss and unauthorized information disclosure, security teams should prioritize patching the MongoDB C++ Driver. Administrators must identify all applications utilizing affected versions of the driver and schedule updates to version 4.5.3 immediately to eliminate the underlying query logic flaw.