See ENGSEC-670. To be addressed by March 22.

Summary

The MongoDB Node.js driver's OIDC authentication includes a host allowlist mechanism to ensure tokens are only sent to trusted servers. The hostMatchesWildcards() function validates hostnames against wildcard patterns (e.g., *.mongodb.net). However, the implementation uses a permissive suffix match that does not enforce a dot-boundary, allowing unrelated domains that merely end with the allowed suffix to pass validation.

For example, with the default ALLOWED_HOSTS of ['*.mongodb.net', ...], a malicious host like evil-mongodb.net incorrectly passes the check because 'evil-mongodb.net'.endsWith('mongodb.net') evaluates to true, even though it is not a subdomain of mongodb.net.

This enables an attacker who can redirect a victim's connection (via DNS poisoning, SRV record manipulation, or config tampering) to bypass the OIDC host restriction and capture authentication tokens.

Applications using OIDC authentication may leak credentials to attacker-controlled servers that bypass the host allowlist via lookalike domains (e.g.,

evil-mongodb.net

). This can lead to account takeover, unauthorized database access, and potential data breaches. Organizations using MongoDB Atlas with OIDC SSO are particularly at risk.

Details

Scenario: 1

node-mongodb-native-main/src/utils.ts:83-94

**
 * Determines if a connection's address matches a user provided list
 * of domain wildcards.
 */
export function hostMatchesWildcards(host: string, wildcards: string[]): boolean {
  for (const wildcard of wildcards) {
    if (
      host === wildcard ||
      (wildcard.*startsWith('*.')* && host?.*endsWith*(*wildcard.substring(2, wildcard.length)*)) ||
      (wildcard.*startsWith('*/')* && host?.*endsWith*(*wildcard.substring(2, wildcard.length)*))
    ) {
      return true;
    }
  }
  return false;
}

Recommendations

Modify

hostMatchesWildcards()

to require a dot-boundary before the matched suffix or set explicit, stricter

ALLOWED_HOSTS

in connection options.

Risks/Unknowns

• What could go wrong while implementing this change? (e.g., performance, inadvertent behavioral changes in adjacent functionality, existing tech debt, etc)
• Is there an opportunity for better cross-driver alignment or testing in this area?
• Is there an opportunity to improve existing documentation on this subject?

Inadvertently allowing previously-blocked addresses, or blocking or previously-allowed addresses.
Cross-driver testing in this area is necessary, we don't know if only Node is impacted.

Acceptance Criteria

Implementation Requirements

• Host `evil-mongodb.net` does not match wildcard `*.mongodb.net`

Testing Requirements

• Tests for host `evil-mongodb.net` and wildcard `*.mongodb.net`
  Add more tests to cover other scenarios. Ensure all existing tests are passing without changes.

Documentation Requirements

• None

Follow Up Requirements

• Confirm other drivers don't have a similar issue.