CVE-2025-11535: MongoDB Connector for BI Privilege Escalation

CVE-2025-11535 Overview

CVE-2025-11535 is a local privilege escalation vulnerability in the MongoDB Connector for Business Intelligence (BI) installer for Windows. The MSI installer fails to set access control lists (ACLs) on custom installation directories. Any authenticated local user can modify binaries or configuration files inside the connector's install path. When the connector runs under a privileged service account, the attacker gains elevated code execution. The flaw is tracked under CWE-276: Incorrect Default Permissions and affects MongoDB Connector for BI versions 2.0.0 through 2.14.24.

Critical Impact
Local low-privileged users can overwrite connector files installed to custom directories and execute arbitrary code with the privileges of the BI Connector service, resulting in full system compromise.

Affected Products

MongoDB Connector for BI 2.0.0 through 2.14.24 (Windows MSI installations)
Installations that specified a custom (non-default) install directory
Windows hosts running the BI Connector service under an elevated account

Discovery Timeline

2025-10-08 - CVE-2025-11535 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11535

Vulnerability Analysis

The MongoDB Connector for BI translates SQL queries into MongoDB queries, allowing BI tools to interact with MongoDB deployments. On Windows, the product is delivered as an MSI package. When an administrator selects a custom installation directory during setup, the MSI does not apply restrictive ACLs to the resulting folder. The directory inherits permissions from its parent, which frequently allow write access to the Users or Authenticated Users groups. Because the connector service typically runs with higher privileges than the interactive user, a local attacker can leverage the writable directory to escalate privileges.

Root Cause

The root cause is CWE-276: Incorrect Default Permissions. The MSI installer relies on the security descriptor inherited from the chosen parent directory rather than explicitly applying a hardened ACL. Default installs under C:\Program Files\ inherit administrator-only write access, but custom paths such as C:\MongoBI\ or D:\Apps\ typically inherit permissive ACLs that permit writes by non-administrative users.

Attack Vector

An authenticated local attacker locates the connector's install directory and confirms write access. The attacker replaces mongosqld.exe, a supporting DLL, or the service configuration file with an attacker-controlled payload. When the BI Connector Windows service restarts, at boot, on schedule, or after an administrator-triggered restart, Windows loads the malicious binary under the service account. This yields code execution at the privilege level of the service, commonly LocalSystem or a dedicated service account with broader rights than the attacker. Refer to the MongoDB BI Connector Release Notes for vendor guidance.

Detection Methods for CVE-2025-11535

Indicators of Compromise

Unexpected modifications to mongosqld.exe, mongodrdl.exe, or DLLs within the BI Connector install directory
New or modified files in the connector directory with non-administrative ownership
BI Connector service processes spawning cmd.exe, powershell.exe, or other interactive shells
Service restarts of the BI Connector followed by suspicious child process creation

Detection Strategies

Audit ACLs on all BI Connector installation directories using icacls and flag any that grant write permissions to non-administrative principals
Monitor file integrity for executables and configuration files inside the connector install path
Alert on process lineage where the BI Connector service parent creates unexpected child processes
Correlate Windows Security event ID 4663 (object access) and 7045 (service installation) for the connector service account

Monitoring Recommendations

Enable Windows object access auditing on the BI Connector install directory
Forward Sysmon Event IDs 1, 7, and 11 covering process creation, image load, and file creation to a centralized log platform
Track service configuration changes for the mongosql service across the environment

How to Mitigate CVE-2025-11535

Immediate Actions Required

Upgrade MongoDB Connector for BI to version 2.14.25 or later on all Windows hosts
Inventory hosts that used custom install directories and remediate ACLs on those paths immediately
Restrict the BI Connector service account to the minimum privileges required for operation
Remove write and modify permissions for Users and Authenticated Users on the install directory

Patch Information

MongoDB addressed the issue in BI Connector version 2.14.25. The release notes are available at the MongoDB BI Connector Release Notes. Applying the update alone does not repair pre-existing permissive ACLs on custom directories; administrators must manually harden those paths.

Workarounds

Reinstall the connector to the default C:\Program Files\ location, which inherits administrator-only write permissions
Manually apply restrictive ACLs granting write access only to Administrators and SYSTEM on the custom install path
Disable the BI Connector service on hosts where it is not actively required until patching is complete

bash

# Harden ACLs on a custom MongoDB BI Connector install directory
icacls "D:\Apps\MongoBI" /inheritance:r
icacls "D:\Apps\MongoBI" /grant:r "Administrators:(OI)(CI)F"
icacls "D:\Apps\MongoBI" /grant:r "SYSTEM:(OI)(CI)F"
icacls "D:\Apps\MongoBI" /grant:r "Users:(OI)(CI)RX"
icacls "D:\Apps\MongoBI" /remove "Authenticated Users"