MongoDB Server v4.4-7.0 TLS CAFile Validation Skip - Untrusted Connections
CVE-2024-1351 Published on March 7, 2024
MongoDB Server may allow successful untrusted connection
Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failing certificate validation. This issue affects MongoDB Server v7.0 versions prior to and including 7.0.5, MongoDB Server v6.0 versions prior to and including 6.0.13, MongoDB Server v5.0 versions prior to and including 5.0.24 and MongoDB Server v4.4 versions prior to and including 4.4.28.
Required Configuration : A server process will allow incoming connections to skip peer certificate validation if the server process was started with TLS enabled (net.tls.mode set to allowTLS, preferTLS, or requireTLS) and without a net.tls.CAFile configured.
Vulnerability Analysis
Weakness Type
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Products Associated with CVE-2024-1351
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-1351 are published in these products:
Affected Versions
MongoDB Inc MongoDB Server:- Version 7.0, <= 7.0.5 is affected.
- Version 6.0, <= 6.0.13 is affected.
- Version 5.0, <= 5.0.24 is affected.
- Version 4.4, <= 4.4.28 is affected.
- Version 7.0, <= 7.0.5 is affected.
- Version 6.0, <= 6.0.13 is affected.
- Version 5.0, <= 5.0.24 is affected.
- Version 4.4, <= 4.4.28 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.