CVE-2024-10921
📋 TL;DR
An authenticated MongoDB user can cause server crashes or read unauthorized memory contents by sending specially crafted requests with malformed BSON. This affects MongoDB Server versions 5.0 before 5.0.30, 6.0 before 6.0.19, 7.0 before 7.0.15, and 8.0 up to 8.0.2.
💻 Affected Systems
- MongoDB Server
📦 What is this software?
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
Mongodb by Mongodb
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure of sensitive server memory contents leading to credential theft or data leakage, combined with denial of service through server crashes.
Likely Case
Server crashes causing temporary denial of service, potentially disrupting database operations and applications.
If Mitigated
Limited impact with proper authentication controls and network segmentation, though authenticated users could still cause disruptions.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of BSON manipulation. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.30, 6.0.19, 7.0.15, 8.0.3
Vendor Advisory: https://jira.mongodb.org/browse/SERVER-96419
Restart Required: Yes
Instructions:
1. Download patched version from MongoDB website. 2. Stop MongoDB service. 3. Backup data and configuration. 4. Install patched version. 5. Restart MongoDB service. 6. Verify version and functionality.
🔧 Temporary Workarounds
Restrict User Privileges
allLimit authenticated users to minimal necessary privileges to reduce attack surface.
db.updateUser('username', {roles: [{'role': 'read', 'db': 'database'}]})
Network Access Controls
linuxImplement strict network segmentation and firewall rules to limit MongoDB access.
iptables -A INPUT -p tcp --dport 27017 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 27017 -j DROP
🧯 If You Can't Patch
- Implement strict authentication and authorization controls to limit user access
- Deploy network segmentation and firewall rules to restrict MongoDB access to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Connect to MongoDB and run: db.version() to check if version falls in affected ranges.Check Version:
db.version()Verify Fix Applied:
After patching, run: db.version() to confirm version is 5.0.30, 6.0.19, 7.0.15, or 8.0.3+.📡 Detection & Monitoring
Log Indicators:
- Unexpected server crashes/restarts
- Authentication logs showing unusual user activity
- Error logs containing BSON parsing failures
Network Indicators:
- Unusual patterns of authenticated requests to MongoDB
- Multiple connection attempts with malformed data
SIEM Query:
source="mongodb.log" AND ("crash" OR "restart" OR "BSON" AND "error")