Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.6
CVE-2022-48282: MongoDB .NET/C# Driver allows remote code execution
CVE-2022-48282 · published 3 years ago
Summary
If a C# application that uses the MongoDB driver stores user‑provided data without checking it, and the app runs on Windows with the full .NET Framework, an attacker who can write to the database could make the program run their own code. This could disrupt services or expose the system to further attacks. Update the driver to a version newer than 2.18.0 and ensure input validation and safe data models are used.
What to do
- Update mongodb inc. mongodb.driver to version 2.19.0.
- Update mongodb c\#_driver to version 2.19.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| nuget | mongodb inc. | mongodb.driver |
< 2.19.0 Fix: upgrade to 2.19.0
|
| – | mongodb | c\#_driver |
< 2.19.0 cpe:2.3:a:mongodb:c\#_driver:*:*:*:*:*:mongodb:*:* |
Original advisory text
Deserializing compromised object with MongoDB .NET/C# Driver may cause remote code execution
Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0
Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND
* Application must be running on a Windows host using the full .NET Framework, not .NET Core AND
* Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND
* Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable
Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND
* Application must be running on a Windows host using the full .NET Framework, not .NET Core AND
* Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND
* Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-48282 Vendor Advisory
- https://jira.mongodb.org/CSHARP-4475
- https://jira.mongodb.org/browse/CSHARP-4475 URL
- https://security.netapp.com/advisory/ntap-20230324-0003/ Vendor Advisory
- https://github.com/advisories/GHSA-7j9m-j397-g4wx
- https://github.com/mongodb/mongo-csharp-driver/releases/tag/v2.19.0 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48282... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
6.6
Medium
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published21 Feb 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta