CVE-2025-11695 MongoDB Rust驱动TLS证书验证绕过漏洞

# CVE-2025-11695 PoC - MongoDB Rust Driver TLS Certificate Validation Bypass # This PoC demonstrates how the vulnerability manifests when tlsInsecure=False is set # Vulnerable connection string (user expects secure connection, but gets insecure) # When tlsInsecure=False appears, certificate validation is unexpectedly disabled use mongodb::{Client, options::ClientOptions}; #[tokio::main] async fn main() -> Result<(), Box<dyn std::error::Error>> { // Vulnerable connection string with tlsInsecure=False // Expected behavior: Certificate validation should be ENABLED // Actual behavior (vulnerable): Certificate validation is DISABLED let uri = "mongodb://localhost:27017/?tls=true&tlsInsecure=false&tlsCAFile=/path/to/ca.pem"; let client_options = ClientOptions::parse(uri).await?; let client = Client::with_options(client_options)?; // Connection will succeed even with invalid certificates // due to the vulnerability - certificate validation is bypassed let db = client.database("test"); let collection = db.collection::<Document>("users"); // Query executes despite TLS validation being incorrectly disabled let cursor = collection.find(doc! {}).await?; // Attacker performing MITM can intercept all this traffic println!("Connection established - TLS validation bypassed!"); Ok(()) } # Attacker-side MITM demonstration using mitmproxy or similar tool: # 1. Set up ARP spoofing or position on network path # 2. Intercept TLS connection from vulnerable client # 3. Present any certificate (even self-signed) # 4. Client accepts connection without validation # 5. Capture and modify all MongoDB traffic # Verification steps: # 1. Use a MongoDB server with a self-signed or invalid certificate # 2. Connect using the vulnerable driver with tlsInsecure=false # 3. Observe that the connection succeeds when it should fail # 4. Compare with fixed version (v3.2.5+) where connection correctly fails