mongostat uses the serverStatus command and the auth credentials provided must include the clusterAdmin role in 2.4.

This should be noted in the documentation, eg: http://docs.mongodb.org/manual/reference/mongostat/#cmdoption-mongostat--username.