Executive brief
MongoDB Connector for BI is a tool that translates MongoDB queries into SQL for compatibility with SQL databases. The connector fails to properly escape special characters when converting JSON schema validator descriptions into SQL comments, allowing a user with schema modification permissions to inject malicious SQL code. If an operator or tool replays the generated SQL statements against a SQL server, the injected SQL executes with full session privileges, potentially compromising the SQL database.
Technical details
The vulnerability is a SQL injection issue in the MongoDB Connector for BI's DDL generation logic. When a collection's JSON schema validator description is incorporated into SHOW CREATE statement output, backslash characters are not completely escaped in the resulting SQL comment text. An attacker with permission to modify a collection's schema validator can craft a malicious description containing SQL syntax that breaks out of the comment context when the DDL is replayed. The attack requires both schema modification privileges and a subsequent action (manual or automated replay of the DDL) against a SQL server. The injected SQL executes in the context of the replaying session's privileges.
Affected products
- MongoDB Connector for BI <UNKNOWN>
Timeline
- 2026-08-28: disclosed