A critical security flaw in the MongoDB C Driver allows authenticated attackers to perform unauthorized data access or cause data loss via improper query neutralization.

The vulnerability involves improper neutralization of special elements in data query logic (CWE-943) within the GridFS component. An authenticated user can influence file identifiers to cause them to be interpreted as query conditions, enabling unauthorized access to file content or the deletion of GridFS file chunks.

This vulnerability poses a significant risk to data integrity and confidentiality. Successful exploitation allows an attacker to bypass intended access controls to read sensitive files or perform destructive actions by removing file chunks, which can lead to permanent data loss and system unavailability. With a CVSS score of 8.3, this high-severity vulnerability requires immediate attention to prevent operational disruption and unauthorized exposure of information stored within GridFS.

Immediate Action: Update the MongoDB C Driver to version 1.30.10 or 2.5.3 immediately to incorporate the necessary security patches.

Proactive Monitoring: Review application access logs for unusual query patterns or unexpected deletion events involving the GridFS component.

Compensating Controls: Ensure that application-level input validation is strictly enforced for all identifiers passed to the GridFS driver, and restrict database user permissions to the minimum necessary level to reduce the potential blast radius of an exploit.

Public Exploit Available: Unknown

Given the potential for significant data loss and unauthorized information disclosure, organizations utilizing the MongoDB C Driver must prioritize upgrading to the fixed versions. Ensure that all affected development environments and production systems are updated to mitigate the risk of query injection within the GridFS component.