SERVER-130264: Intra-cluster SASL mechanism allowlist missing in egress connection setup, enabling PLAIN downgrade and cleartext keyfile disclosure
MongoDB Server's intra-cluster egress connection setup (TLConnectionSetupHook::validateHost) copies the saslSupportedMechs array from unauthenticated hello replies without filtering against a client-side allowlist. A party with suitable network access can forge a hello reply advertising only PLAIN, causing the connecting node to pass PLAIN through authenticateInternal() and getInternalAuthParams, which returns the raw keyfile string as the credential password. The result is a PLAIN saslStart carrying the raw keyfile in cleartext sent to the attacker-controlled socket. PLAIN is already blocked for speculative SASL start, confirming the intent to exclude it; the non-speculative path was left unguarded. The fix adds a hardcoded allowlist of SCRAM-SHA-256, SCRAM-SHA-1, and MONGODB-X509, silently discarding any other mechanism. Fixed in MongoDB 7.0.40, 8.0.29, 8.2.13, 8.3.8, and 9.0.0-rc2. The keyfile disclosure implies cluster compromise as the keyfile authenticates the internal __system user, though the JIRA defers full security-impact analysis to the restricted SECBUG-1100.
Research notes
- Root causeMongoDB's intra-cluster egress connection setup (TLConnectionSetupHook::validateHost) copies the saslSupportedMechs array from unauthenticated hello replies directly into _saslMechsForInternalAuth without filtering against a client-side allowlist, allowing a forged hello reply advertising only PLAIN to pass through unmodified.
- Technical detailThe first mechanism from _saslMechsForInternalAuth is passed to authenticateInternal() with no further validation, and getInternalAuthParams accepts PLAIN as a valid mechanism, returning the raw keyfile string as the credential password. The result is a PLAIN saslStart carrying the raw keyfile in cleartext sent to the attacker-controlled socket.
- ExploitationPLAIN is already blocked for speculative SASL start, confirming the intent to exclude it from this code path; the non-speculative path was left unguarded. The fix adds a hardcoded allowlist of SCRAM-SHA-256, SCRAM-SHA-1, and MONGODB-X509, silently discarding any other mechanism including PLAIN.