Improper File Identifier Handling in pymongo: PYTHON-5994
Summary
GHSA-8h2c-ghff-mpg9: Duplicate Advisory: pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods. Affects pymongo versions < 4.18.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pymongo is the official Python driver for MongoDB, allowing Python applications to interact with MongoDB databases seamlessly. It provides a rich set of features for database operations, including support for GridFS, which is a specification for storing and retrieving large files. However, a vulnerability exists in the GridFS component that can lead to improper handling of file identifiers, potentially exposing sensitive data or causing data loss.
Vulnerability Detail
The vulnerability arises from improper neutralization of special elements in data query logic within the GridFS component of the MongoDB Python Driver. This flaw allows an authenticated user to manipulate the structured file identifier passed by an application, leading to unintended consequences. Specifically, the identifier may be interpreted as a query condition instead of a literal identifier. As a result, a malicious user could access stored file content beyond the intended target or delete all GridFS file chunks in the affected bucket, rendering the stored content unreadable. The rename operation may also affect files other than the intended target, posing a significant risk to data integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that file identifiers are validated and sanitized before being passed to GridFS methods. This can help mitigate the risk of unauthorized access or data manipulation. Implementing strict checks on the format and content of identifiers can prevent exploitation of this vulnerability.
Conclusion
The pymongo vulnerability related to improper handling of file identifiers in GridFS poses significant risks to data integrity and security. It is crucial for users to update to the latest version of pymongo and implement necessary validation measures to mitigate potential exploitation.
See every vulnerability recorded for pymongo →
FAQ
The vulnerability has a CVSS score of 8.3, indicating a high level of severity.
Any application using pymongo versions up to 4.18.0 that utilizes GridFS for file storage is potentially affected.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files or complete data loss due to deletion of file chunks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert provides a service that monitors your dependencies in real-time for open-source vulnerabilities using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for pymongo.
