CVE-2024-3372

What it actually does

Improper validation of metadata input causes the server to produce incorrectly serialized BSON, resulting in unexpected application behavior and unavailability of serverStatus responses.

Why it matters to the business

Database servers can become partially unavailable, disrupting monitoring and operational queries without requiring authentication.

How an attack unfolds

An unauthenticated remote attacker sends crafted metadata that triggers faulty BSON serialization, leading to degraded server responses including loss of serverStatus functionality.

How to fix it

Upgrade MongoDB Server to 7.0.6 or later, 6.0.14 or later, or 5.0.25 or later. Apply the commit 17c0d8bbee46f15f1574079e266a9997cebe6d0e for source builds.

How to confirm the fix worked

Verify running version is at or above the fixed releases, confirm serverStatus responses are returned normally, and test with malformed metadata inputs in a non-production environment.

Typical attack path

1. Identify exposed MongoDB instances listening on the network
2. Craft and send malicious metadata input pre-authentication
3. Trigger incorrect BSON serialization on the server
4. Observe denial of serverStatus and other unexpected behaviors

How to detect it

Review MongoDB logs for malformed metadata processing errors, unexpected serverStatus unavailability, or BSON serialization failures originating from unauthenticated connections.

What your security team should do

• Immediately upgrade all affected MongoDB deployments to the fixed versions
• Restrict network access to MongoDB instances until patches are applied
• Monitor for unusual serverStatus failures or BSON-related errors in logs