Cloudanix VulnDB

CVE-2024-1351

High · 8.8

CVSS

8.8

EPSS

0.5%

Published

Mar 7, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Some MongoDB servers can accept connections from computers using fake security certificates instead of rejecting them, which may let outsiders reach data they should not.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
Network Service
Class
Misconfiguration
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

MongoDB Server skips peer certificate validation for incoming TLS connections when net.tls.mode is set to allowTLS/preferTLS/requireTLS but net.tls.CAFile is not configured, allowing untrusted certificates to succeed.

Why it matters to the business

Deployments may accept connections from untrusted parties, raising the risk of data exposure, unauthorized access, or tampering in production MongoDB clusters that remain on affected versions.

How an attack unfolds

An attacker on the same network supplies a forged or self-signed certificate to a MongoDB server started with TLS enabled but without a CAFile; because validation is bypassed the connection is accepted, enabling impersonation or man-in-the-middle access to the database.

How to fix it

Upgrade all affected MongoDB Server instances to a build containing commit 17c0d8bbee46f15f1574079e266a9997cebe6d0e (or later releases beyond 7.0.5, 6.0.13, 5.0.24, 4.4.28) and configure net.tls.CAFile whenever TLS is enabled.

How to confirm the fix worked

Inspect mongod.conf or command-line flags for the presence of net.tls.CAFile on every TLS-enabled node; attempt a connection with an untrusted certificate and verify it is rejected; confirm the running binary matches a patched build.

Typical attack path

  1. Scan for MongoDB instances listening with TLS enabled
  2. Confirm absence of net.tls.CAFile in the running configuration
  3. Present an invalid certificate during the TLS handshake
  4. Establish an authenticated or unauthenticated session that should have been rejected

How to detect it

Review MongoDB startup logs and configuration files for the absence of net.tls.CAFile when TLS mode is not disabled; search connection logs for sessions established without certificate validation.

What your security team should do

  • Audit every MongoDB deployment for missing net.tls.CAFile when TLS is active
  • Apply the fixed commit or upgrade to the listed patched versions immediately
  • Enforce requireTLS together with a valid CAFile in all production environments
  • Add configuration checks to deployment pipelines and infrastructure-as-code

The record

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28. Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami mongodb 4.4.0 5.0.26
Ubuntu:14.04:LTS mongodb 0 No fix
Ubuntu:16.04:LTS mongodb 0 No fix
Ubuntu:18.04:LTS mongodb 0 No fix
Ubuntu:20.04:LTS mongodb 0 No fix
Ubuntu:Pro:14.04:LTS mongodb 0 No fix
Ubuntu:Pro:16.04:LTS mongodb 0 No fix
Ubuntu:Pro:18.04:LTS mongodb 0 No fix
Ubuntu:Pro:20.04:LTS mongodb 0 No fix

Related vulnerabilities