CVE-2024-8305

What it actually does

A flaw in prepareUnique index constraint enforcement on replica set secondaries allows crafted operations to trigger crashes, and in extreme cases multiple secondaries may fail leaving no primary.

Why it matters to the business

Replica set availability can be lost, causing application downtime and requiring manual intervention to restore a primary node.

How an attack unfolds

An attacker with write access identifies a collection using prepareUnique indexes and issues targeted write operations that expose the incorrect secondary constraint handling, resulting in secondary crashes that can cascade to loss of a primary.

How to fix it

Upgrade MongoDB Server to 6.0.17 or later, 7.0.13 or later, or 7.3.4 or later; the fix is present in commit a2a46542e8d79a8b4937ed51e84dc918caf26783.

How to confirm the fix worked

Confirm the running MongoDB version meets or exceeds the listed fixed releases and inspect replica set status and logs for absence of prepareUnique-related secondary crashes.

Typical attack path

1. Locate a MongoDB collection configured with a prepareUnique index
2. Issue write operations that trigger secondary-specific index constraint checks
3. Cause repeated crashes on secondaries until no primary remains

How to detect it

Examine MongoDB server logs on secondaries for repeated crashes mentioning prepareUnique indexes or index constraint enforcement failures.

What your security team should do

• Apply the fixed MongoDB versions to all affected replica sets without delay
• Review replica set logs for prior secondary crashes tied to index enforcement
• Validate failover behavior in staging environments after upgrade