CVE-2024-7553

What it actually does

Incorrect validation of files loaded from a local untrusted directory on Windows allows the application to execute arbitrary behavior determined by untrusted file contents, enabling local privilege escalation.

Why it matters to the business

Attackers with local access on Windows systems could escalate privileges to compromise database operations and data integrity across affected MongoDB deployments, increasing risk in environments with high ecosystem prevalence of dependent packages.

How an attack unfolds

An attacker with local access on Windows places malicious files in an untrusted directory; when the MongoDB process loads files without proper validation, it executes the attacker's arbitrary code to escalate privileges. No named threat actors or ransomware campaigns are associated.

How to fix it

Upgrade MongoDB Server to 5.0.27+, 6.0.16+, 7.0.12+, or 7.3.3+; update MongoDB C Driver to 1.26.2+ and PHP Driver to 1.18.1+. Apply fixes such as 0a095119d792a0dc719fceb932267f4a33dd51e8 for mongodb/mongo GIT and 0.3-6.el8 for redfish-finder (AlmaLinux:8).

How to confirm the fix worked

Confirm installed versions meet or exceed the fixed releases listed; review application logs and file load paths for references to untrusted directories on Windows systems.

Typical attack path

1. Obtain local access to a Windows system hosting affected MongoDB components
2. Place crafted malicious files in a local untrusted directory
3. Trigger the MongoDB process to load files from that directory
4. Execute arbitrary code to achieve local privilege escalation

How to detect it

Examine MongoDB process logs and Windows event logs for unexpected file loads or executions originating from untrusted local directories; no specific threat actor indicators are present.

What your security team should do

• Apply the specified version upgrades immediately on all Windows MongoDB deployments
• Restrict local user access and directory permissions to minimize untrusted file exposure
• Monitor EPSS trend stability and re-evaluate if exploit maturity changes