Hot answers tagged

21

NoSQL databases are relatively new (although arguably an old concept), I haven't seen any specific MongoDB hardening guides and the usual places I look (CISSecurity, vendor publications, Sans etc all come up short). Suggests it would be a good project for an organisation, uni student, infosec community to write one and maintain it. There is some basic ...


10

Insecure Direct Object Reference Client-Side Enforcement of Server Side Security Server-Side JavaScript Injection Also MongoDB should not be assessable to the public. It can be password protected, and passwords can be brute-forced. Client-Side js can communicate with MongoDB directly, and MongoDB can authenticate individual users. However their ...


7

There are injection attacks against MongoDB, but these are largely mitigated by using proper data adapter libraries. Nonetheless, it's worth knowing that it's possible to inject in a few ways. The first thing you've got to look out for is cases where you dynamically build a $where with JavaScript, using user input. By modifying their inputs, they may be ...


6

Your requirements aren't cloud specific. This same solution will work with a traditional hosting. The hallmark of cloud computing is dynamic resource consumption by booting up VM's only when you need them. 1)As far as I know MongoDB doesn't support SSL. In order to have a secure connection to MongoDB you'll have to use a VPN to create a safe tunnel. ...


6

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much more efficiently with a common find-query or aggregation, especially one as trivial as this. But this is security stackexchange, not stackoverflow, so let's focus ...


5

The answer to this (not just MongoDB, but any program) is quite system dependent. If you are running MongoDB with SSL enabled at compile time, and enabled at run-time, and it's using a vulnerable OpenSSL (1.0.1—1.0.1f with hearbeat not explicitly removed), then yes. If you are only listening on localhost, or you have packet filtering/firewalling to allow ...


5

Just for your information. Giving a direct database connection in a client side application is a bad idea. Build a RESTful interface which allows for correct authentication and input validation. This will allow you to have a stricter control on what your applications can access. The problem is that currently MongoDB doesn't offer SSL encapsulation. This ...


4

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, then follows the actual attack while(1); (DOS attack), and then the still standing ' is transformed to valid syntax via var foo='bar. Up to version 2.4 of ...


4

In a sense, that can be considered correct. From what I understood from the MongoDB documentation, the db.addUser() expects one to pass in an already hashed password. This is clearly seen from the documentation of the function, where the expected data type of the pwd field is hash. I read this as MongoDB expecting the system to perform the hashing prior to ...


4

If you think the database engine you're planning to use isn't secure enough, then I wouldn't advise using it for anything. If it is secure enough, then the added complexity of two different database APIs will make your life harder, and not really affect an attacker (they'll just dump it to a file anyway). If you want the data physically separate, you could ...


3

Mongo database connections will be able to use SSL at some point in the future, but that isn't available yet. Writing to have a more recent reference for this one. From https://docs.mongodb.org/manual/tutorial/configure-ssl/ New in version 3.0: Most MongoDB distributions now include support for SSL. ... Certain distributions of MongoDB do ...


3

First vulnerability similar to sql injection can be done in mongodb or nosql databases too. which would be mongodb injection. Try to run mongodb on different port instead on default 27017 to avoid exposing. For official security practices you can always check out http://docs.mongodb.org/manual/administration/security/ It tell security practices that should ...


3

MongoDB is only about 1/10 related to what you are asking, I think. You basically want to know how to securely store data, and associated keys in the cloud. There are entire books written on this... :) Your question may be too broad for me to offer any reasonable answer, but others may be able to do better. With that being said, there is a great patterns ...


2

Few very initial things to remember are: Remove IP Binding from all to just the IP (private or localhost), you expect to get Connection Request Change the default Port Bindings Give only required permissions (like no update/delete permissions to select query users) Setup ssh keys for required master-slave connection, removing involvement of passwords You ...


2

According to Mongo's documentation, the following is used to construct an ObjectId: ObjectId is a 12-byte BSON type, constructed using: a 4-byte value representing the seconds since the Unix epoch, a 3-byte machine identifier, a 2-byte process id, and a 3-byte counter, starting with a random value. So to answer your question, Is there ...


1

Giving away information in the URL An URL might be accessible even to a person that is not supposed to have access to the actual page it leads to. After all URLs can show up in links all over the web or leak via referer headers. Therefore there should be no sensitive information in the URL. The Mongo ID contains information about the time the object was ...


1

The OWASP mentions that simply having any sort of direct identifier can be bad, as explained in the Top 10 2007-Insecure Direct Object Reference and Top 10 2010-A4-Insecure Direct Object References entries. An attacker that can figure out how to exploit such an direct reference will have far more power than they should. The OWASP actually recommends using ...


1

I can't think of any real security risk to exposing the mongoDB id (versus some other counter id), other than exposing creation time according to the server to the users. Having the mongo primary key vs some other unique key (like a counter) shouldn't make a difference in terms of exposure. Granted you should be aware, the mongo _id consists of: a ...


1

This exposes meta information in the MongoDB ID as stated in the answer from dr jimbob which is a security concern in some aspects. Another way to post this question is What is the best practice for not exposing meta information about the entries in my DB in links and URIs? The answer to that question is simple: Use a unique identifier field for the ...


1

The tool NoSQLMap includes a lot of functionality that directly targets MongoDB. https://github.com/tcstool/NoSQLMap There is an even-better video available that shows all sorts of attacks. You will also find that NoSQLMap calls out to the metasploit-framework, e.g., exploit/linux/misc/mongod_native_helper The project also suggests a viewing of this DEF ...


1

If you are generating version 4 UUIDs using a cryptographically secure RNG, the probability of a previously issued token matching a currently valid token is exactly the same as the probability of any random token created by the attacker matching a current token. This means that an attacker with previous tokens has no advantage over any other attacker, and ...


1

Here is a checklist for MongoDB security Enable auth – Even if you have deployed your Mongodb servers in a trusted network it is good security practice to enable auth. It provides you “Defense in depth” if your network is compromised. Edit your mongod configuration file to enable auth Don’t expose your production db to the internet – Restricting physical ...



Only top voted, non community-wiki answers of a minimum length are eligible