CVE-2022-24272 in MongoDB
Summary
by MITRE • 04/21/2022
An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2025
The vulnerability described in CVE-2022-24272 represents a critical denial of service weakness within MongoDB Server version 5.0, specifically affecting releases prior to and including v5.0.6. This issue manifests when an authenticated user executes a command that triggers an invariant assertion during the command dispatch process, fundamentally disrupting the database server's operational integrity. The flaw specifically targets the validation mechanisms governing the $external database, which serves as a critical component for external authentication in MongoDB environments.
The technical root cause of this vulnerability lies in insufficient input validation within the command processing pipeline of the MongoDB server. When an authenticated user submits a command that interacts with the $external database, the system fails to properly validate the command parameters against established assertions. This validation failure results in an invariant assertion being triggered, causing the mongod process to terminate unexpectedly. The vulnerability operates at the command dispatch level, where the server's internal consistency checks are bypassed due to inadequate parameter validation. This type of flaw aligns with CWE-225, which categorizes weaknesses related to inadequate input validation and improper handling of exceptional conditions.
The operational impact of this vulnerability extends beyond simple service disruption, as it can lead to complete server crashes that compromise database availability and integrity. An authenticated attacker with access to the MongoDB instance can exploit this weakness to cause denial of service conditions, potentially affecting business-critical applications that depend on MongoDB for data persistence. The vulnerability's authenticated nature means that it requires legitimate user credentials, but this does not mitigate the risk since compromised accounts or insider threats can still exploit the flaw. The crash condition can result in data loss, transaction failures, and extended downtime while system administrators restore service. This vulnerability particularly affects MongoDB Server v5.0 versions, which were widely deployed in production environments, amplifying the potential impact across numerous organizations.
Mitigation strategies for CVE-2022-24272 primarily focus on immediate patching of affected MongoDB server versions. Organizations should prioritize upgrading to MongoDB Server v5.0.7 or later, where the validation issue has been resolved through enhanced parameter checking mechanisms. Additionally, implementing network segmentation and access controls can reduce the attack surface by limiting access to authenticated users only, though this does not eliminate the risk entirely. Security monitoring should include detection of unusual command execution patterns and server crash events that may indicate exploitation attempts. The vulnerability demonstrates the importance of robust input validation and proper assertion handling in database server implementations, aligning with ATT&CK technique T1499.004 for network denial of service. Organizations should also conduct comprehensive security assessments of their MongoDB deployments to identify potential similar validation weaknesses in other components of their database infrastructure.