MongoDB Server up to 5.0.24/6.0.13/7.0.5 BSON deserialization

Summaryinfo

A vulnerability, which was classified as critical, has been found in MongoDB Server up to 5.0.24/6.0.13/7.0.5. This affects an unknown function of the component BSON Handler. Performing a manipulation results in deserialization. This vulnerability is known as CVE-2024-3372. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in MongoDB Server up to 5.0.24/6.0.13/7.0.5. This affects an unknown functionality of the component BSON Handler. The manipulation with an unknown input leads to a deserialization vulnerability. CWE is classifying the issue as CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. This is going to have an impact on availability. The summary by CVE is:

Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25.

It is possible to read the advisory at jira.mongodb.org. This vulnerability is uniquely identified as CVE-2024-3372 since 04/05/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 5.0.25, 6.0.14 or 7.0.6 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Database Software

Vendor

• MongoDB

Name

• Server

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9
• 5.0.10
• 5.0.11
• 5.0.12
• 5.0.13
• 5.0.14
• 5.0.15
• 5.0.16
• 5.0.17
• 5.0.18
• 5.0.19
• 5.0.20
• 5.0.21
• 5.0.22
• 5.0.23
• 5.0.24
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8
• 6.0.9
• 6.0.10
• 6.0.11
• 6.0.12
• 6.0.13
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion