Questions tagged [mongodb]

MongoDB is a scalable, high-performance, open source, document-oriented database. It supports a large number of languages and application development platforms.

Filter by
Sorted by
Tagged with
2
votes
1answer
42 views

MongoIDs and confidentiality

Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually ...
0
votes
1answer
434 views

Is it so easy to hack mongodb database?

Is it so easy to hack mongodb database? I created a mongodb database and added users. If I want to allow access only to these users I need to add the following parameters to the config file: ...
0
votes
0answers
16 views

How to securly upload images into monogdb

I'm using mongodb, Nodejs and express. I'm creating a webbApp and i want to give to the users the featur to upload their profile image, I saw Here that there are some risks by letting the user upload ...
1
vote
2answers
100 views

Should Google User ID's be hashed when stored in the database

I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods. I'm basically treating the Google ID and Password as credentials here. I'm already ...
0
votes
2answers
80 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
2
votes
1answer
779 views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
0
votes
2answers
175 views

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

So as the title says I'm just deploying my first ever app in production. Because I don't have experience, I was told to ask someone who knows this stuff. So how should I ensure the best security for ...
0
votes
1answer
46 views

Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?

A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup ufw allow 127017 ufw allow 127017/tcp No user authentication ...
0
votes
1answer
42 views

Linking mail server with application database

I have a web application running on node.js, backed by a MongoDB database which stores user data etc... I'd like to offer my users an email account, so I've set up a mail server using Postfix, dovecot,...
1
vote
2answers
2k views

How MiTM attack got performed on self-signed certificate while private keys is generated by ourselves?

On MongoDB I have enabled SSL/TLS feature to encrypt data transmission between client and server. But what I have done is to generate a self-signed certificate using openssl in linux. The question is ...
0
votes
1answer
138 views

Suspicious app name in Windows 10 permission prompt

I downloaded MongoDB 3.4 from the MongoDB website here When I run the .msi file to install, I am prompted with the following screen asking me if I trust a39adfe.msi A Google search for a39adfe.msi ...
2
votes
2answers
102 views

Should I be thinking about security at the database row/document level?

Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends. There is logic in the application to ensure both ...
1
vote
1answer
64 views

Verify that input is a string - is it safe?

I was trying to find out how to prevent MongoDB injections, and I came across this. So, the vulnerable code here is app.post('/', function (req, res) { db.users.find({username: req.body....
1
vote
0answers
393 views

How secure is my MLab Shared Cluster MongoDB database?

I have deployed a Meteor application to Meteor Galaxy. I've also created an Mlab.com Shared Cluster MongoDB. Link to the plan features. My application has an SSL certificate installed on the domain. ...
4
votes
1answer
492 views

Storing UK bank account and sort code in MongoDB database

The company I work for has to send monthly payments to 20 to 50 users at a time. These users can change from month to month. Generally, each user will receive money from us for 2-3 months. The users ...
5
votes
2answers
450 views

MongoDB/Debian server successfully attacked - reason for public ip to get to mongodb server?

I got a mongodb server which from the logfiles got a connection from a remote ip address, though its obviously not allowed (or to be more precise: the mongod is not bound to any public interface) due ...
0
votes
1answer
366 views

mongodb --auth option

Suppose I run mongodb as a service with the --auth option (requiring a username and password to CRUD data) in an AWS EC2 shell (which does not ask for a password when you sudo) Now, suppose someone ...
1
vote
0answers
143 views

is my stack secure on mongodb if i use mongos out-of-box username/password roles? [closed]

is my stack secure on mongodb if i use mongos out-of-box username/password and roles for generating tokens, and I do not personally attempt to come up with a salt+hash for usernames & passwords (...
-1
votes
1answer
439 views

How to recover Mongodb database in EC2 instance [duplicate]

Please help me how i can recover my database. "WARNING" : "YOUR DBS ARE ENCRYPTED. SEND 0.5 BTC (BITCOIN) ~= 550USD, TO THIS BTC ADDRESS: 15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f AND CONTACT THIS EMAIL: ...
1
vote
1answer
420 views

OpenSSH login to a system account

While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running. Through a Google search I figured out this vulnerability with the above OpenSSH version I went in to ...
1
vote
0answers
1k views

Help injecting a MongoDB used by a Python web app

this is a follow up to this thread. So I am trying to perform a NoSQL injection on a web application that is written in Python and connects to a MongoDB backend. The issue I am having is that I am ...
2
votes
2answers
959 views

Proving that a MongoDB is misconfigured and publicly accessible

If Mongo databases appear on www.Shodan.io, is it definitive proof that they are publicly accessible? Is there a way to prove without doubt there is a risk without actually connecting to the server? (...
4
votes
4answers
5k views

Security risks of using MongoDB ID vs a counter in URL? [duplicate]

In my Angular app, I use the MongoDB id in the URLs. Are there any security risks to this? Should I use a counter instead, and then in my DB have some sort of collection that links this counter to ...
4
votes
0answers
400 views

MongoDB injection, reading and writing to files

I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go ...
2
votes
0answers
475 views

Store encrypted data and encryption key on different MongoDB servers? [closed]

In my Rails app users are submitting sensitive username/password combinations to their webshop systems so my app can interact with them. I need to enforce a high data-at-rest security for these data. ...
11
votes
2answers
20k views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
6
votes
2answers
4k views

Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?

I'm developing a RESTful API using MongoDB as the backend. The easiest thing to do programmatically would be to simply use MongoDB's _id field in the URI, such as: https://api.example.com/collection/...
1
vote
1answer
536 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
1
vote
1answer
564 views

Central Authentication Server for SSH and Web wanted

I have many client devices that I need to reverse SSH tunnel into. I am finding that managing all these certificate files are becoming cumbersome. I am looking into a centralized authentication system....
2
votes
1answer
1k views

Field-level encryption vs disk encryption for PCI compliance

We are in the process of setting up a PCI compliant server (with Firehost's help). We are using MongoDB as our primary database. I am having some concerns about the encryption, though. Are there any ...
1
vote
1answer
3k views

Is a mongodb build that uses the -ssl option vulnerable to heartbleed?

If one is using MongoDB enterprise, or built MongoDB from source using the -ssl option (as described here), is that MongoDB vulnerable to the heartbleed bug? I know mongo needed openssl-devel to be ...
1
vote
0answers
364 views

Designing a security and encryption strategy for MongoHQ

I'm trying to design the best strategy to achieve the following goals: Securing data-on-the-wire between my server and MongoHQ. Encrypting all data-at-rest with MongoHQ (possibly key values as well). ...
5
votes
2answers
2k views

How secure is MongoDB wire protocol?

I'm building a JavaFX 2.0 standalone application (it'll be distributed as an .exe) and it opens a connection to a MongoDB instance. The connection is just a standard Mongo connection using the Mongo ...
5
votes
2answers
6k views

Isn't MongoDB actually storing plaintext passwords?

According to the documentation at http://docs.mongodb.org/meta-driver/latest/legacy/implement-authentication-in-driver/: The driver then runs the authenticate command for the database on which to ...
1
vote
1answer
888 views

What are Security Practices for NoSql databases [duplicate]

I want to know what are the best practices to secure NoSql database like MongoDB. How is it possible? Any tips?
22
votes
4answers
27k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
7
votes
1answer
7k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
28
votes
3answers
19k views

How to secure a MongoDB instance? [closed]

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
11
votes
2answers
6k views

Encrypting with Mongo

How can I achieve the following goals? All compute and storage to be located in the cloud. Encryption in transit of all data between web nodes and db nodes running MongoDB. How to set up tunnels? ...