When tlsInsecure=False appears in a connection string, certificate validation is disabled.
This vulnerability affects MongoDB Rust Driver versions prior to v3.2.5
The following code is for security research and authorized testing only.
python
# CVE-2025-11695 PoC - MongoDB Rust Driver TLS Certificate Validation Bypass
# This PoC demonstrates how the vulnerability manifests when tlsInsecure=False is set
# Vulnerable connection string (user expects secure connection, but gets insecure)
# When tlsInsecure=False appears, certificate validation is unexpectedly disabled
use mongodb::{Client, options::ClientOptions};
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
// Vulnerable connection string with tlsInsecure=False
// Expected behavior: Certificate validation should be ENABLED
// Actual behavior (vulnerable): Certificate validation is DISABLED
let uri = "mongodb://localhost:27017/?tls=true&tlsInsecure=false&tlsCAFile=/path/to/ca.pem";
let client_options = ClientOptions::parse(uri).await?;
let client = Client::with_options(client_options)?;
// Connection will succeed even with invalid certificates
// due to the vulnerability - certificate validation is bypassed
let db = client.database("test");
let collection = db.collection::<Document>("users");
// Query executes despite TLS validation being incorrectly disabled
let cursor = collection.find(doc! {}).await?;
// Attacker performing MITM can intercept all this traffic
println!("Connection established - TLS validation bypassed!");
Ok(())
}
# Attacker-side MITM demonstration using mitmproxy or similar tool:
# 1. Set up ARP spoofing or position on network path
# 2. Intercept TLS connection from vulnerable client
# 3. Present any certificate (even self-signed)
# 4. Client accepts connection without validation
# 5. Capture and modify all MongoDB traffic
# Verification steps:
# 1. Use a MongoDB server with a self-signed or invalid certificate
# 2. Connect using the vulnerable driver with tlsInsecure=false
# 3. Observe that the connection succeeds when it should fail
# 4. Compare with fixed version (v3.2.5+) where connection correctly fails