Summary

A slightly malformed MongoDB connection string makes the provider throw an error that prints the full string, password included, into application logs.

Impact

The plaintext database password is written to application logs and crash telemetry whenever the connection string is malformed, allowing anyone with log access to recover a live database credential and defeating the provider's own redaction mechanism.
Severity: critical
Exploitability: likely_exploitable — Any log reader passively harvests the live database credential whenever the deployment's connection string is malformed — a common misconfiguration (unencoded password characters) that requires no attacker action to trigger.
Customer data: credentials, secrets (logs)

Location

• src/MongoDB.EntityFrameworkCore/Infrastructure/MongoOptionsExtension.cs:268 in SanitizeConnectionStringForLogging
• src/MongoDB.EntityFrameworkCore/Infrastructure/MongoOptionsExtension.cs:81 in WithConnectionString
• src/MongoDB.EntityFrameworkCore/Infrastructure/MongoOptionsExtension.cs:56 in MongoOptionsExtension(copyFrom)
• src/MongoDB.EntityFrameworkCore/Extensions/MongoDbContextOptionsExtensions.cs:73 in UseMongoDB

Reproduction / trigger path

Analyzed trigger path from static analysis — not an executed PoC. Confirm with a concrete repro before handing off.

Attacker controls: The deployment's configuration source (environment variable, config file, secret store, or startup code) fully determines the leaked content; a log reader controls nothing but observes the complete unredacted connection string.

1. (source) src/MongoDB.EntityFrameworkCore/Extensions/MongoDbContextOptionsExtensions.cs:73 in UseMongoDB — Application startup passes the raw connection string from configuration (env vars, appsettings, secret stores) into the provider with no format validation.
2. (hop) src/MongoDB.EntityFrameworkCore/Infrastructure/MongoOptionsExtension.cs:81 in WithConnectionString — After only a null check (line 76), the raw string is handed to the logging sanitizer.
3. (sink) src/MongoDB.EntityFrameworkCore/Infrastructure/MongoOptionsExtension.cs:268 in SanitizeConnectionStringForLogging — Unguarded MongoUrlBuilder parse throws a driver exception whose message quotes the full unredacted connection string (including password) before the redaction at line 269 runs; the exception propagates to startup error handling, which default .NET hosts write to service logs.

Root cause

• SanitizeConnectionStringForLogging constructs `new MongoUrlBuilder(connectionString)` with no try/catch (src/MongoDB.EntityFrameworkCore/Infrastructure/MongoOptionsExtension.cs:268); the driver's parse failure exception quotes the full raw URL, so the exception carries the unredacted password out of the redaction helper before the `Password = "redacted"` assignment at line 269 ever runs.
• WithConnectionString only null-checks its input (MongoOptionsExtension.cs:76) and invokes the throwing sanitizer at line 81, so any malformed configuration value fails inside the logging helper with the secret in the message.
• The public entry points UseMongoDB(connectionString, ...) (src/MongoDB.EntityFrameworkCore/Extensions/MongoDbContextOptionsExtensions.cs:73 and :118) pass the raw configuration string straight through; grep confirms no other writer of ConnectionString exists, and no validation gate sits on the path.
• The codebase demonstrates the safe pattern elsewhere: the identical parse is wrapped in `catch (FormatException)` at src/MongoDB.EntityFrameworkCore/Storage/MongoClientWrapper.cs:137, while the sanitizer takes no such precaution.

Ownership

Assigned teams: @mongodb/dbx-csharp-dotnet

Filed from Aegis finding 80529ee45339 (scan scan-6cd4cd27c8ab) · primitive: Unguarded URL parse inside the redaction helper throws a driver exception quoting the raw, password-bearing connection string. · categories: Credential Exposure, Secret Leakage, Error Information Leak

https://docs.google.com/document/d/1osPjSiI-pvMXtrI49QVqwrIK21_nU38fsp7tJlQpDlY/edit?tab=t.0#heading=h.biijq6ke6z0p