Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mongodb]

MongoDB is a scalable, high-performance, open source, document-oriented database. It supports a large number of languages and application development platforms.

1
vote
1answer
32 views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
0
votes
2answers
76 views

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

So as the title says I'm just deploying my first ever app in production. Because I don't have experience, I was told to ask someone who knows this stuff. So how should I ensure the best security for ...
0
votes
1answer
39 views

Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?

A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup ufw allow 127017 ufw allow 127017/tcp No user authentication ...
0
votes
1answer
30 views

Linking mail server with application database

I have a web application running on node.js, backed by a MongoDB database which stores user data etc... I'd like to offer my users an email account, so I've set up a mail server using Postfix, dovecot,...
0
votes
2answers
799 views

How MiTM attack got performed on self-signed certificate while private keys is generated by ourselves?

On MongoDB I have enabled SSL/TLS feature to encrypt data transmission between client and server. But what I have done is to generate a self-signed certificate using openssl in linux. The question is ...
0
votes
0answers
3k views

Mongodb $where injection

'$where': "this.CompanyName == How can I leverage this to trigger a reverse shell? I can execute commands through a search box, but have failed to successfully get the payload to execute even though ...
0
votes
1answer
127 views

Suspicious app name in Windows 10 permission prompt

I downloaded MongoDB 3.4 from the MongoDB website here When I run the .msi file to install, I am prompted with the following screen asking me if I trust a39adfe.msi A Google search for a39adfe.msi ...
2
votes
2answers
98 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
1
vote
1answer
61 views

Verify that input is a string - is it safe?

I was trying to find out how to prevent MongoDB injections, and I came across this. So, the vulnerable code here is app.post('/', function (req, res) { db.users.find({username: req.body....
1
vote
0answers
333 views

How secure is my MLab Shared Cluster MongoDB database?

I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features. My application has an SSL certificate installed on the domain. ...
4
votes
1answer
321 views

Storing UK bank account and sort code in MongoDB database

The company I work for has to send monthly payments to 20 to 50 users at a time. These users can change from month to month. Generally, each user will receive money from us for 2-3 months. The users ...
6
votes
2answers
412 views

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
0
votes
1answer
327 views

mongodb --auth option

Suppose I run mongodb as a service with the --auth option (requiring a username and password to CRUD data) in an AWS EC2 shell (which does not ask for a password when you sudo) Now, suppose someone ...
1
vote
0answers
126 views

is my stack secure on mongodb if i use mongos out-of-box username/password roles? [closed]

is my stack secure on mongodb if i use mongos out-of-box username/password and roles for generating tokens, and I do not personally attempt to come up with a salt+hash for usernames & passwords (...
-1
votes
1answer
351 views

How to recover Mongodb database in EC2 instance [duplicate]

Please help me how i can recover my database. "WARNING" : "YOUR DBS ARE ENCRYPTED. SEND 0.5 BTC (BITCOIN) ~= 550USD, TO THIS BTC ADDRESS: 15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f AND CONTACT THIS EMAIL: ...
1
vote
1answer
304 views

OpenSSH login to a system account

While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running. Through a Google search I figured out this vulnerability with the above OpenSSH version I went in to ...
1
vote
0answers
1k views

Help injecting a MongoDB used by a Python web app

this is a follow up to this thread. So I am trying to perform a NoSQL injection on a web application that is written in Python and connects to a MongoDB backend. The issue I am having is that I am ...
2
votes
2answers
873 views

Proving that a MongoDB is misconfigured and publicly accessible

If Mongo databases appear on www.Shodan.io, is it definitive proof that they are publicly accessible? Is there a way to prove without doubt there is a risk without actually connecting to the server? (...
3
votes
4answers
4k views

Security risks of using MongoDB ID vs a counter in URL? [duplicate]

In my Angular app, I use the MongoDB id in the URLs. Are there any security risks to this? Should I use a counter instead, and then in my DB have some sort of collection that links this counter to ...
4
votes
0answers
339 views

MongoDB injection, reading and writing to files

I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go ...
2
votes
0answers
418 views

Store encrypted data and encryption key on different MongoDB servers? [closed]

In my Rails app users are submitting sensitive username/password combinations to their webshop systems so my app can interact with them. I need to enforce a high data-at-rest security for these data. ...
10
votes
2answers
16k views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
6
votes
2answers
3k views

Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?

I'm developing a RESTful API using MongoDB as the backend. The easiest thing to do programmatically would be to simply use MongoDB's _id field in the URI, such as: https://api.example.com/collection/...
1
vote
1answer
487 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
1
vote
1answer
434 views

Central Authentication Server for SSH and Web wanted

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication system....
2
votes
1answer
1k views

Field-level encryption vs disk encryption for PCI compliance

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
1
vote
1answer
3k views

Is a mongodb build that uses the -ssl option vulnerable to heartbleed?

If one is using MongoDB enterprise, or built MongoDB from source using the -ssl option (as described here), is that MongoDB vulnerable to the heartbleed bug? I know mongo needed openssl-devel to be ...
1
vote
0answers
358 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as well). ...
5
votes
2answers
2k views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
5
votes
2answers
6k views

Isn't MongoDB actually storing plaintext passwords?

According to the documentation at http://docs.mongodb.org/meta-driver/latest/legacy/implement-authentication-in-driver/: The driver then runs the authenticate command for the database on which to ...
1
vote
1answer
872 views

What are Security Practices for NoSql databases [duplicate]

I want to know what are the best practices to secure NoSql database like MongoDB. How is it possible? Any tips?
20
votes
4answers
26k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
7
votes
1answer
6k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
28
votes
3answers
19k views

How to secure a MongoDB instance? [closed]

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
11
votes
2answers
6k views

Encrypting with Mongo

How can I achieve the following goals? All compute and storage to be located in the cloud. Encryption in transit of all data between web nodes and db nodes running MongoDB. How to set up tunnels? ...