MongoDB Shell Control Character Injection Vulnerability via Autocomplete

A control character injection vulnerability has been identified in the MongoDB Shell (mongosh) versions prior to 2.3.9. This issue allows an attacker to manipulate the autocomplete feature to inject and execute obfuscated malicious text. Exploitation requires user interaction, specifically the use of the 'tab' key to autocomplete text that matches the prefix of the attacker's prepared autocompletion. The vulnerability can only be exploited when mongosh is connected to a cluster that is partially or fully controlled by the attacker.

Impact

Exploitation of this vulnerability could lead to the execution of injected malicious text, potentially allowing for further exploitation or manipulation within the MongoDB environment.

Remediation

Users can upgrade to MongoDB Shell version 2.3.9 or later to address this vulnerability.