LangChain MongoDBChatMessageHistory Query Injection Vulnerability (CVE-2024-10619) Advisory

Summary of MongoDBChatMessageHistory Query Injection Vulnerability Vulnerability Overview MongoDBChatMessageHistory does not enforce the string type defined in the document for session identifiers at runtime. In affected applications, structured session identifiers may be interpreted as MongoDB query conditions rather than literal identifiers. Scope of Impact Affected Versions: <= 1.3.0 Fixed Versions: 1.3.1 Impact Description: - Applications are affected if they pass unvalidated session identifiers into and store histories for multiple users. - Attackers capable of invoking operations may be able to read, modify, or delete conversation data stored for other users. - Applications that derive session identifiers from server-controlled values after authentication and enforce their type are not vulnerable via this vector. Remediation Patch: - The issue has been resolved in version 1.3.1 of . - Affected versions should be upgraded to 1.3.1 or later. The patch validates session identifiers at runtime and ensures they are compared as literals in MongoDB queries. Temporary Workarounds If an immediate upgrade is not possible, applications should reject session identifiers that are not non-empty strings. Session identifiers should be derived from server-controlled values after authentication and must not be passed directly from untrusted request fields. Upgrading remains the recommended remediation. Additional Information Severity: Medium (6.0 / 10) CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: Low - User Interaction: None - Impact Metrics: - Confidentiality: High - Integrity: Low - Availability: None - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None CVE ID: CVE-2024-10619 Weakness: CWE-943 Contributors: laohut-from-NightWolf-Team --- Note: No specific Proof-of-Concept (POC) or exploit code is included in the source document.

Goal Reached Thanks to every supporter — we hit 100%!

LangChain MongoDBChatMessageHistory Query Injection Vulnerability (CVE-2024-10619) Advisory

More from this source