CVE-2024-3374

What it actually does

Unauthenticated remote attacker triggers a fatal assertion crash by causing the server to attempt construction of an oversized BSON object during ftdc diagnostic metric generation.

Why it matters to the business

Service availability is disrupted as the server terminates unexpectedly, leading to downtime for dependent applications and potential data inaccessibility until restart.

How an attack unfolds

An attacker sends crafted requests over the network that invoke diagnostic metric collection, forcing the server to build a BSON structure exceeding internal memory limits and triggering an assertion failure.

How to fix it

Upgrade MongoDB Server 5.0 installations to versions after 5.0.16 and 6.0 installations to versions after 6.0.5. Apply vendor patches promptly and validate the update through version checks.

How to confirm the fix worked

Confirm server version is newer than the affected releases, review release notes for the fix, and test that diagnostic metric generation no longer produces assertion failures under load.

Typical attack path

1. Identify exposed MongoDB server instance listening on the network
2. Send unauthenticated requests that trigger ftdc metric generation
3. Cause oversized BSON object construction leading to fatal assertion
4. Observe server crash and loss of availability

How to detect it

Search server logs for fatal assertion messages related to BSON size limits during ftdc metric generation and correlate with unexpected process terminations.

What your security team should do

• Prioritize upgrade of all exposed MongoDB instances to fixed versions
• Restrict network access to database ports to trusted sources only
• Monitor for unexpected server restarts and assertion logs
• Review and limit diagnostic metric collection frequency if feasible