Questions tagged [mongodb]

MongoDB is a scalable, high-performance, open source, document-oriented database. It supports a large number of languages and application development platforms.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

Detect Security Configuration Changes on MongoDB Atlas

Is there a way to detect security configuration changes on my MongoDB Atlas project and trigger an alert if e.g. somebody changes Network Access rules? I can't find any suitable rules in Alert ...
0
votes
0answers
85 views

Possible no sql injection?

We are developing a application in Dotnet MVC with mongodb as a database. We use below mentioned query in order fetch the data from the database. Controller code: [Get("getmsg")] Public ...
0
votes
0answers
65 views

MongoDB NoSQLi in Cockpit CMS - use of $func?

Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave? As I understand ...
0
votes
1answer
120 views

How to securely store users API keys submitted through client

I am developing a web application which will require users to provide 3rd party API keys through the client, which will then be used to make requests to the 3rd party API from the backend of my app. ...
0
votes
1answer
44 views

Why would you use random algorithm for CSFLE if you can't query the inserted data?

I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following: "...
0
votes
0answers
84 views

Bypass Login with MongoDB Injection

So I'm a bit stuck on a (potential) MongoDB injection vulnerability where (body-parser) is used. I have a JSON request body of {"username":"example@domain.com","password":...
1
vote
1answer
103 views

How secure is setting mongodb to 0.0.0.0 but blocking all incoming requests to 27017 on ec2?

As the title suggests. If I set the net.bindIp setting in mongod.conf to 0.0.0.0 on port 27017 this should open it up to all incoming connections. However, if in my ec2 instance I whitelist only my ...
1
vote
1answer
2k views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
0
votes
0answers
100 views

What's the best way to encrypt and store text in a MongoDB database?

I have a "cloud service", which consists of 2 parts: Web application, written in Next.js; MongoDB database (uses MongoDB Atlas). I allow users to sign in with GitHub and handle ...
1
vote
1answer
5k views

Shellcode in MongoDB Python code

I know I can input this into a search box that queries the MongoDB. I have updated the code with my shell code, but I won't include that, I will just use the exploit as it is here: db.my_collection....
2
votes
2answers
69 views

MongoIDs and confidentiality

Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
0
votes
1answer
2k views

Is it so easy to hack mongodb database?

Is it so easy to hack mongodb database? I created a mongodb database and added users. If I want to allow access only to these users I need to add the following parameters to the config file: ...
1
vote
2answers
562 views

Should Google User ID's be hashed when stored in the database

I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods. I'm basically treating the Google ID and Password as credentials here. I'm already ...
0
votes
2answers
127 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
3
votes
1answer
3k views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
0
votes
2answers
381 views

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

So as the title says I'm just deploying my first ever app in production. Because I don't have experience, I was told to ask someone who knows this stuff. So how should I ensure the best security for ...
0
votes
1answer
225 views

Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?

A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup ufw allow 127017 ufw allow 127017/tcp No user authentication ...
0
votes
1answer
135 views

Linking mail server with application database

I have a web application running on node.js, backed by a MongoDB database which stores user data etc... I'd like to offer my users an email account, so I've set up a mail server using Postfix, dovecot,...
2
votes
2answers
7k views

How MiTM attack got performed on self-signed certificate while private keys is generated by ourselves?

On MongoDB I have enabled SSL/TLS feature to encrypt data transmission between client and server. But what I have done is to generate a self-signed certificate using openssl in linux. The question is ...
1
vote
1answer
257 views

Suspicious app name in Windows 10 permission prompt

I downloaded MongoDB 3.4 from the MongoDB website here When I run the .msi file to install, I am prompted with the following screen asking me if I trust a39adfe.msi A Google search for a39adfe.msi ...
2
votes
2answers
111 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
1
vote
1answer
82 views

Verify that input is a string - is it safe?

I was trying to find out how to prevent MongoDB injections, and I came across this. So, the vulnerable code here is app.post('/', function (req, res) { db.users.find({username: req.body....
1
vote
0answers
461 views

How secure is my MLab Shared Cluster MongoDB database?

I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features. My application has an SSL certificate installed on the domain. ...
4
votes
1answer
661 views

Storing UK bank account and sort code in MongoDB database

The company I work for has to send monthly payments to 20 to 50 users at a time. These users can change from month to month. Generally, each user will receive money from us for 2-3 months. The users ...
5
votes
2answers
529 views

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
0
votes
1answer
404 views

mongodb --auth option

Suppose I run mongodb as a service with the --auth option (requiring a username and password to CRUD data) in an AWS EC2 shell (which does not ask for a password when you sudo) Now, suppose someone ...
-1
votes
1answer
719 views

How to recover Mongodb database in EC2 instance [duplicate]

Please help me how i can recover my database. "WARNING" : "YOUR DBS ARE ENCRYPTED. SEND 0.5 BTC (BITCOIN) ~= 550USD, TO THIS BTC ADDRESS: 15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f AND CONTACT THIS EMAIL: ...
2
votes
1answer
592 views

OpenSSH login to a system account

While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running. Through a Google search I figured out this vulnerability with the above OpenSSH version I went in to ...
1
vote
0answers
3k views

Help injecting a MongoDB used by a Python web app

this is a follow up to this thread. So I am trying to perform a NoSQL injection on a web application that is written in Python and connects to a MongoDB backend. The issue I am having is that I am ...
2
votes
2answers
1k views

Proving that a MongoDB is misconfigured and publicly accessible

If Mongo databases appear on www.Shodan.io, is it definitive proof that they are publicly accessible? Is there a way to prove without doubt there is a risk without actually connecting to the server? (...
7
votes
4answers
8k views

Security risks of using MongoDB ID vs a counter in URL? [duplicate]

In my Angular app, I use the MongoDB id in the URLs. Are there any security risks to this? Should I use a counter instead, and then in my DB have some sort of collection that links this counter to ...
5
votes
0answers
473 views

MongoDB injection, reading and writing to files

I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go ...
2
votes
0answers
521 views

Store encrypted data and encryption key on different MongoDB servers? [closed]

In my Rails app users are submitting sensitive username/password combinations to their webshop systems so my app can interact with them. I need to enforce a high data-at-rest security for these data. ...
11
votes
2answers
26k views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
8
votes
2answers
6k views

Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?

I'm developing a RESTful API using MongoDB as the backend. The easiest thing to do programmatically would be to simply use MongoDB's _id field in the URI, such as: https://api.example.com/collection/...
1
vote
1answer
698 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
1
vote
1answer
884 views

Central Authentication Server for SSH and Web wanted

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication system....
2
votes
1answer
2k views

Field-level encryption vs disk encryption for PCI compliance

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
1
vote
1answer
3k views

Is a mongodb build that uses the -ssl option vulnerable to heartbleed?

If one is using MongoDB enterprise, or built MongoDB from source using the -ssl option (as described here), is that MongoDB vulnerable to the heartbleed bug? I know mongo needed openssl-devel to be ...
1
vote
0answers
381 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as well). ...
5
votes
2answers
2k views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
6
votes
2answers
8k views

Isn't MongoDB actually storing plaintext passwords?

According to the documentation at http://docs.mongodb.org/meta-driver/latest/legacy/implement-authentication-in-driver/: The driver then runs the authenticate command for the database on which to ...
1
vote
1answer
957 views

What are Security Practices for NoSql databases [duplicate]

I want to know what are the best practices to secure NoSql database like MongoDB. How is it possible? Any tips?
22
votes
4answers
28k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
9
votes
1answer
8k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
28
votes
3answers
19k views

How to secure a MongoDB instance? [closed]

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
11
votes
2answers
6k views

Encrypting with Mongo

How can I achieve the following goals? All compute and storage to be located in the cloud. Encryption in transit of all data between web nodes and db nodes running MongoDB. How to set up tunnels? ...