MongoDB Without Authentication
Overview
MongoDB instances without authentication allow any client that reaches the port to read, write, or delete all databases. This has led to numerous mass data breaches. Default MongoDB installations prior to 3.0 had no authentication.
Remediation
- Enable
--authflag or setsecurity.authorization: enabledinmongod.conf - Create admin user with strong password before exposing MongoDB
- Bind to localhost or use VPC/firewall rules
- Use TLS for connections