CVE-2015-4412

Vulnerability

The legal? function in the BSON::ObjectId class of the bson-ruby gem before version 3.0.4 contains a BSON injection vulnerability. The flaw arises because the regular expression used to validate hexadecimal ObjectId strings uses ^ and $ anchors instead of \A and \Z. In Ruby, ^ and $ match line boundaries rather than string boundaries, allowing a crafted string containing newline characters to bypass validation [2]. This affects applications using Mongoid, Mongo Mapper, or any library relying on BSON::ObjectId.legal? to validate user-supplied _id values.

Exploitation

An attacker can exploit this by providing a specially crafted string that includes a newline character followed by arbitrary BSON data. For example, a string like 24hexcharacters\n<injected_bson> would pass the legal? check because the regex matches only the first 24 hex characters on the first line [2]. The attacker does not need authentication if the application accepts unauthenticated input as an _id parameter. The injection is performed by sending the malicious string to a service that validates ObjectId using legal?, such as a web endpoint that queries MongoDB based on user-supplied IDs.

Impact

Successful exploitation can lead to denial of service through resource consumption or injection of arbitrary data into BSON queries [1]. In the best case, the attacker causes a low-severity DoS; in the worst case, they can perform BSON injection similar to SQL injection, potentially reading, modifying, or deleting data in MongoDB [2]. The impact depends on how the application uses the parsed BSON data after injection.

Mitigation

Upgrade to bson-ruby version 3.0.4 or later, which fixes the regular expression to use \A and \Z anchors [2]. As of the last available information, no workaround was published for versions before 3.0.4. This vulnerability is not listed on the CISA KEV as of the current date. The fix was released on 2015-06-08 per the gem changelog.