Preface: What Is a Document Database? A document-oriented database is a special type of key-value store where keys can only be strings. Moreover, the document is encoded using standards like JSON or related languages like XML. You can also store PDFs, image files, or text documents directly as values.

Background: As a document database, MongoDB makes it easy for developers to store structured or unstructured data. It uses a JSON-like format to store documents. Most breaches involving MongoDB occur because of a deadly combination of authentication disabled and MongoDB opened to the internet.

Vulnerability details: Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underlying operating systems is Windows. This may result in the application executing arbitrary behaviour determined by the contents of untrusted files.

Impact: This issue affects MongoDB Server v5.0 versions prior to 5.0.27, MongoDB Server v6.0 versions prior to 6.0.16, MongoDB Server v7.0 versions prior to 7.0.12, MongoDB Server v7.3 versions prior 7.3.3, MongoDB C Driver versions prior to 1.26.2 and MongoDB PHP Driver versions prior to 1.18.1. Required Configuration: Only environments with Windows as the underlying operating system is affected by this issue

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2024-7553