Hot answers tagged

15

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much more efficiently with a common find-query or aggregation, especially one as trivial as this. But this is security stackexchange, not stackoverflow, so let's focus ...


14

Insecure Direct Object Reference Client-Side Enforcement of Server Side Security Server-Side JavaScript Injection Also MongoDB should not be assessable to the public. It can be password protected, and passwords can be brute-forced. Client-Side js can communicate with MongoDB directly, and MongoDB can authenticate individual users. However their ...


13

While this is true, that is true for many applications. If the attacker already has access to the file system it is far too late to worry about your database server. In unix-type operating systems, the configuration file should be accessible only as root (as it is in /etc/mongodb/mongodb.conf). If the attacker has root privileges to change that file, you're ...


8

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, then follows the actual attack while(1); (DOS attack), and then the still standing ' is transformed to valid syntax via var foo='bar. Up to version 2.4 of MongoDB,...


8

According to Mongo's documentation, the following is used to construct an ObjectId: ObjectId is a 12-byte BSON type, constructed using: a 4-byte value representing the seconds since the Unix epoch, a 3-byte machine identifier, a 2-byte process id, and a 3-byte counter, starting with a random value. So to answer your question, Is there ...


7

There are injection attacks against MongoDB, but these are largely mitigated by using proper data adapter libraries. Nonetheless, it's worth knowing that it's possible to inject in a few ways. The first thing you've got to look out for is cases where you dynamically build a $where with JavaScript, using user input. By modifying their inputs, they may be ...


5

Just for your information. Giving a direct database connection in a client side application is a bad idea. Build a RESTful interface which allows for correct authentication and input validation. This will allow you to have a stricter control on what your applications can access. The problem is that currently MongoDB doesn't offer SSL encapsulation. This ...


5

The answer to this (not just MongoDB, but any program) is quite system dependent. If you are running MongoDB with SSL enabled at compile time, and enabled at run-time, and it's using a vulnerable OpenSSL (1.0.1—1.0.1f with hearbeat not explicitly removed), then yes. If you are only listening on localhost, or you have packet filtering/firewalling to allow ...


4

Mongo database connections will be able to use SSL at some point in the future, but that isn't available yet. Writing to have a more recent reference for this one. From https://docs.mongodb.org/manual/tutorial/configure-ssl/ New in version 3.0: Most MongoDB distributions now include support for SSL. ... Certain distributions of MongoDB do not ...


4

If you think the database engine you're planning to use isn't secure enough, then I wouldn't advise using it for anything. If it is secure enough, then the added complexity of two different database APIs will make your life harder, and not really affect an attacker (they'll just dump it to a file anyway). If you want the data physically separate, you could ...


4

HTTPS is mandatory of course. But there are a lot more of security options. I can provide you some basics: Server technologies You should implement HSTS (Http Strict Transport Security) to force clients to use your HTTPS connection. You didn't specified what is your back-end technology (Java, PHP, etc). You should update your server to the latest versions ...


4

I can't think of any real security risk to exposing the mongoDB id (versus some other counter id), other than exposing creation time according to the server to the users. Having the mongo primary key vs some other unique key (like a counter) shouldn't make a difference in terms of exposure. Granted you should be aware, the mongo _id consists of: a ...


4

This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in "%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can delve into the Windows registry to divine the mapping between original installer and the cached version, but if you'd like extra assurance it is probably easier (...


4

TL;DR: Using self-signed certificates does not mean MITM is possible and using a certificate issued by a public CA does not mean MITM is impossible. But, it is more likely that MITM is possible if self-signed certificates are used because the clients dealing with self-signed certificates often deal with these in the wrong way. Using a self-signed ...


3

If it is publicly facing and unauthenticated it is as easy as using a MongoDB administrative client, plugging in the server details, and connecting. Depending on the client's response would prove it is definitive. This is exactly what Shodan is doing. They spider the internet making connections with everything. And try to dump whatever information they can ...


3

First vulnerability similar to sql injection can be done in mongodb or nosql databases too. which would be mongodb injection. Try to run mongodb on different port instead on default 27017 to avoid exposing. For official security practices you can always check out http://docs.mongodb.org/manual/administration/security/ It tell security practices that should ...


3

I recommend to have a bastion host to access your server via a SSH-port forwarding agent to tighten the SSH aspects. Usually I perform OS hardening images using CIS Benchmark guide. Always focus on 3-tier architecture concepts. I don't recommend to run on the same ports on the same node. You can use docker concepts for your usage. I use the following: ...


3

protection against XSS attacks ... XSS is an attack against the client side, not the server side where the DBMS resides. Thus the choice of DBMS does not matter here. ... and other similar attacks I'm not sure what you consider similar attacks. But when talking about DBMS the main attack vector is SQL injection and in case of NoSQL DBMS like MongoDB ...


2

Here is a checklist for MongoDB security Enable auth – Even if you have deployed your Mongodb servers in a trusted network it is good security practice to enable auth. It provides you “Defense in depth” if your network is compromised. Edit your mongod configuration file to enable auth Don’t expose your production db to the internet – Restricting physical ...


2

The tool NoSQLMap includes a lot of functionality that directly targets MongoDB. https://github.com/tcstool/NoSQLMap There is an even-better video available that shows all sorts of attacks. You will also find that NoSQLMap calls out to the metasploit-framework, e.g., exploit/linux/misc/mongod_native_helper The project also suggests a viewing of this DEF ...


2

I think you should look at OpenSSH Certificates. With certificates you can have one central key (the CA) to give access to multiple servers. There is multiple guides out there on how to do this. Here is one from digitalocean: https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu I have also ...


2

The OWASP mentions that simply having any sort of direct identifier can be bad, as explained in the Top 10 2007-Insecure Direct Object Reference and Top 10 2010-A4-Insecure Direct Object References entries. An attacker that can figure out how to exploit such an direct reference will have far more power than they should. The OWASP actually recommends using ...


2

As lack of information next time plizz include kernel version, docker version and if the client application connects with root user. Possible exploits that they used: compromised database client the application so check that too for vulnerabilities as docker containers share kernel with the host and other containers check kernel version for possible ...


2

1) What are suggestions on preventing this as a security risk? (perhaps owning the mongodb process by a user/group that not even sudo would a allow shutting down? i.e another unknown username/password combination that the hacker would need to brute-force crack?) Defense in depth requires multiple layers of security. You are correct that an attacker gaining ...


2

Unix systems typically have many user accounts for system purposes, used for a particular system service, e.g. to run a particular daemon. The processes that provide that service run as that user, the data files manipulated by the service are owned by that user, and the configuration files are readable by that user (but normally not writable: root, i.e. the ...


2

Note that in the case of MongoDB, the lack of authorization at the shell is by design. It is possible to connect unauthenticated to any MongoDB shell. However you are limited to just seeing the version number of mongo and whether the node you are connected to is a primary or secondary. Unless you authenticate as a user account with privileges for a given ...


2

Generally, what you are describing is the responsibility of the application layer and not the database layer. Your application needs to make sure that only mutually accepted friends are added to the list, and that proper authorization is required to access data. This responsibility can not really be moved over to the database in any simple way, as Pascal ...


2

A man in the middle attack is possible without knowledge of your private key by terminating the connection with your server and having a second connection with the client. Wether this is actually possible has nothing to do with your private key but rather how the trust of the corresponding public key is managed within the client. While obtaining a ...


Only top voted, non community-wiki answers of a minimum length are eligible