Summary
Mongoose's built-in TLS stack may incorrectly accept a certificate for a deeper subdomain when a wildcard certificate covers only a parent domain. An on-path attacker with such a certificate could impersonate the intended host and intercept or modify encrypted client traffic.
Affected context
The issue occurs in Mongoose deployments that use the built-in TLS implementation for client-side certificate hostname verification. It becomes risky when certificate names containing wildcards are compared against hostnames without preserving DNS label boundaries, allowing a pattern such as *.example.com to match a deeper name such as foo.bar.example.com.
Exploit preconditions
- Attack surface: Client-side TLS connections using Mongoose's built-in TLS stack
- Required access: An on-path network position and control of, or access to, a valid wildcard certificate for a parent domain
- Trigger point: Server hostname verification during TLS certificate validation
- Why exploitation is possible: Wildcard matching may cross DNS label boundaries, causing a certificate that should not authorize a deeper subdomain to be accepted
Why this happens
The vulnerability results from hostname verification logic that uses a wildcard matching routine without enforcing DNS label-boundary restrictions. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions rely on matching behavior that can treat a wildcard in a parent-domain position as covering multiple subdomain labels. This is an instance of CWE-295: Improper Certificate Validation, because the client may accept a certificate that does not correctly identify the requested host.
Potential impact
- An attacker may impersonate a protected service
- TLS traffic could be intercepted or modified
- Credentials, tokens, or other sensitive data may be exposed
- Clients could receive manipulated application responses
- Affected connections may support follow-on attacks against dependent systems
General mitigation guidance
Mitigation generally focuses on enforcing standards-compliant hostname verification and preserving DNS label boundaries during wildcard comparison.
Common defensive patterns include:
- Use TLS libraries and hostname-verification APIs that restrict wildcards to a single left-most DNS label
- Avoid custom certificate matching logic where a platform-provided verifier is available
- Treat both Subject Alternative Name and legacy Common Name checks consistently and securely
- Prefer exact host authorization or narrowly scoped certificate names where operationally feasible
- Limit client privileges and sensitive operations so a compromised TLS session has reduced impact
- Apply certificate validation and trust-policy checks before exchanging application data
How teams detect issues like this
Organizations can identify related risks through:
- Static analysis of certificate verification code for wildcard matching and unrestricted glob behavior
- Code review checks covering DNS label boundaries, Subject Alternative Name handling, and Common Name fallback
- TLS integration tests using parent-domain wildcards against one-level and multi-level subdomains
- Policy enforcement requiring standardized hostname-verification APIs rather than generic pattern matchers
- Network monitoring for unexpected certificate identities, trust changes, or suspicious interception indicators
Automated security review tools may help flag custom certificate validation and unsafe wildcard comparisons.
