Questions tagged [mongodb]
MongoDB is a scalable, high-performance, open source, document-oriented database. It supports a large number of languages and application development platforms.
46
questions
0
votes
0
answers
92
views
MongoDB NoSQL Injection extract collections
Is it possible to extract other collections that exists in the database?
Let's say I have 2 collections in the database, they are:
1.users
2.posts
Also we assume the users collection is vulnerable to ...
0
votes
0
answers
53
views
Database TLS and certificates clarification
Is this behaviour of MongoDB secure?
Database TLS is turned on and the client's cert .pem is loaded on the machine. When the client-side app is launched and communicating with the database, the cert ...
1
vote
1
answer
173
views
MongoDB NoSQLi in Cockpit CMS - use of $func?
Please explain how this recent Cockpit CMS exploit works, specifically using the $func operator of the MongoLite library, in more detail. How does it exactly make the PHP code behave?
As I understand ...
2
votes
3
answers
455
views
How to securely store users API keys submitted through client
I am developing a web application which will require users to provide 3rd party API keys through the client, which will then be used to make requests to the 3rd party API from the backend of my app.
...
- 21
0
votes
1
answer
103
views
Why would you use random algorithm for CSFLE if you can't query the inserted data?
I think I really misunderstand something about data encryption. This guide (https://docs.mongodb.com/manual/core/security-client-side-encryption/#randomized-encryption) says the following:
"...
- 103
1
vote
1
answer
209
views
How secure is setting mongodb to 0.0.0.0 but blocking all incoming requests to 27017 on ec2?
As the title suggests. If I set the net.bindIp setting in mongod.conf to 0.0.0.0 on port 27017 this should open it up to all incoming connections. However, if in my ec2 instance I whitelist only my ...
- 143
1
vote
1
answer
4k
views
Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?
I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
- 111
0
votes
1
answer
238
views
What's the best way to encrypt and store text in a MongoDB database?
I have a "cloud service", which consists of 2 parts:
Web application, written in Next.js;
MongoDB database (uses MongoDB Atlas).
I allow users to sign in with GitHub and handle ...
1
vote
1
answer
8k
views
Shellcode in MongoDB Python code
I know I can input this into a search box that queries the MongoDB. I have updated the code with my shell code, but I won't include that, I will just use the exploit as it is here:
db.my_collection....
- 119
2
votes
2
answers
105
views
MongoIDs and confidentiality
Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
0
votes
1
answer
3k
views
Is it so easy to hack mongodb database?
Is it so easy to hack mongodb database?
I created a mongodb database and added users. If I want to allow access only to these users I need to add the following parameters to the config file:
...
- 111
1
vote
2
answers
963
views
Should Google User ID's be hashed when stored in the database
I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods.
I'm basically treating the Google ID and Password as credentials here. I'm already ...
- 119
0
votes
2
answers
172
views
Does choice of DBMS matter for protection against XSS and other injection attacks?
I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three.
Does my choice of DBMS has a role in ...
- 115
4
votes
1
answer
4k
views
Handling User Permissions Between Front-end and Back-end
We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
- 171
0
votes
2
answers
503
views
Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS
So as the title says I'm just deploying my first ever app in production.
Because I don't have experience, I was told to ask someone who knows this stuff.
So how should I ensure the best security for ...
0
votes
1
answer
294
views
Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?
A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup
ufw allow 127017
ufw allow 127017/tcp
No user authentication ...
- 105
0
votes
1
answer
183
views
Linking mail server with application database
I have a web application running on node.js, backed by a MongoDB database which stores user data etc... I'd like to offer my users an email account, so I've set up a mail server using Postfix, dovecot,...
- 143
2
votes
2
answers
8k
views
How MiTM attack got performed on self-signed certificate while private keys is generated by ourselves?
On MongoDB I have enabled SSL/TLS feature to encrypt data transmission between client and server. But what I have done is to generate a self-signed certificate using openssl in linux.
The question is ...
- 1,280
1
vote
1
answer
329
views
Suspicious app name in Windows 10 permission prompt
I downloaded MongoDB 3.4 from the MongoDB website here
When I run the .msi file to install, I am prompted with the following screen asking me if I trust a39adfe.msi
A Google search for a39adfe.msi ...
- 579
2
votes
2
answers
148
views
Should I be thinking about security at the database row/document level?
Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends.
There is logic in the application to ensure both ...
- 579
1
vote
1
answer
131
views
Verify that input is a string - is it safe?
I was trying to find out how to prevent MongoDB injections, and I came across this. So, the vulnerable code here is
app.post('/', function (req, res) {
db.users.find({username: req.body....
- 163
1
vote
0
answers
510
views
How secure is my MLab Shared Cluster MongoDB database?
I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features.
My application has an SSL certificate installed on the domain.
...
- 111
4
votes
1
answer
765
views
Storing UK bank account and sort code in MongoDB database
The company I work for has to send monthly payments to 20 to 50 users at a time. These users can change from month to month. Generally, each user will receive money from us for 2-3 months.
The users ...
- 143
5
votes
2
answers
570
views
MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?
I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
- 177
0
votes
1
answer
444
views
mongodb --auth option
Suppose I run mongodb as a service with the --auth option (requiring a username and password to CRUD data) in an AWS EC2 shell (which does not ask for a password when you sudo)
Now, suppose someone ...
- 149
-1
votes
1
answer
811
views
How to recover Mongodb database in EC2 instance [duplicate]
Please help me how i can recover my database.
"WARNING" : "YOUR DBS ARE ENCRYPTED. SEND 0.5 BTC (BITCOIN) ~= 550USD, TO THIS BTC ADDRESS: 15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f AND CONTACT THIS EMAIL: ...
- 101
2
votes
1
answer
684
views
OpenSSH login to a system account
While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running.
Through a Google search I figured out this vulnerability with the above OpenSSH version
I went in to ...
- 1,512
1
vote
0
answers
3k
views
Help injecting a MongoDB used by a Python web app
this is a follow up to this thread. So I am trying to perform a NoSQL injection on a web application that is written in Python and connects to a MongoDB backend. The issue I am having is that I am ...
- 11
2
votes
2
answers
1k
views
Proving that a MongoDB is misconfigured and publicly accessible
If Mongo databases appear on www.Shodan.io, is it definitive proof that they are publicly accessible?
Is there a way to prove without doubt there is a risk without actually connecting to the server? (...
- 597
8
votes
4
answers
9k
views
Security risks of using MongoDB ID vs a counter in URL? [duplicate]
In my Angular app, I use the MongoDB id in the URLs. Are there any security risks to this?
Should I use a counter instead, and then in my DB have some sort of collection that links this counter to ...
- 181
5
votes
0
answers
574
views
MongoDB injection, reading and writing to files
I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go ...
- 1,427
2
votes
0
answers
560
views
Store encrypted data and encryption key on different MongoDB servers? [closed]
In my Rails app users are submitting sensitive username/password combinations to their webshop systems so my app can interact with them. I need to enforce a high data-at-rest security for these data.
...
- 121
11
votes
2
answers
29k
views
MongoDB Nosql injection in python code
Here is the code snippet for accessing to MongoDB.
client = MongoClient()
db = client.test_database
collection = db.test
# Get data from fields
condition = form.getvalue('name')
if condition:
...
- 439
8
votes
2
answers
6k
views
Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?
I'm developing a RESTful API using MongoDB as the backend. The easiest thing to do programmatically would be to simply use MongoDB's _id field in the URI, such as:
https://api.example.com/collection/...
- 323
1
vote
1
answer
785
views
Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?
I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
- 113
1
vote
1
answer
961
views
Central Authentication Server for SSH and Web wanted
I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication system....
- 11
2
votes
1
answer
2k
views
Field-level encryption vs disk encryption for PCI compliance
We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
- 121
1
vote
1
answer
3k
views
Is a mongodb build that uses the -ssl option vulnerable to heartbleed?
If one is using MongoDB enterprise, or built MongoDB from source using the -ssl option (as described here), is that MongoDB vulnerable to the heartbleed bug?
I know mongo needed openssl-devel to be ...
- 13
1
vote
0
answers
410
views
Designing a security and encryption strategy for MongoHQ
I'm trying to design the best strategy to achieve the following goals:
Securing data-on-the-wire between my server and MongoHQ.
Encrypting all data-at-rest with MongoHQ (possibly key values as well).
...
- 316
5
votes
2
answers
3k
views
How secure is MongoDB wire protocol?
I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
- 155
6
votes
2
answers
8k
views
Isn't MongoDB actually storing plaintext passwords?
According to the documentation at
http://docs.mongodb.org/meta-driver/latest/legacy/implement-authentication-in-driver/:
The driver then runs the authenticate command for the database on which to ...
- 161
2
votes
1
answer
994
views
What are Security Practices for NoSql databases [duplicate]
I want to know what are the best practices to secure NoSql database like MongoDB. How is it possible? Any tips?
- 131
22
votes
4
answers
28k
views
What type of attacks can be used vs MongoDB?
I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
- 3,156
9
votes
1
answer
8k
views
Store user passwords in NoSQL database?
I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
- 193
28
votes
3
answers
20k
views
How to secure a MongoDB instance? [closed]
Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
- 2,575
11
votes
2
answers
7k
views
Encrypting with Mongo
How can I achieve the following goals?
All compute and storage to be located in the cloud.
Encryption in transit of all data between web nodes and db nodes running MongoDB.
How to set up tunnels? ...
- 2,817