MongoDB Without Authentication

Detects MongoDB connections without authentication credentials or configurations that disable authorization.

zakirkun a0e1707 2 files · 2.8 KB Updated

File contents

MongoDB Without Authentication

Overview

MongoDB instances without authentication allow any client that reaches the port to read, write, or delete all databases. This has led to numerous mass data breaches. Default MongoDB installations prior to 3.0 had no authentication.

Remediation

  • Enable --auth flag or set security.authorization: enabled in mongod.conf
  • Create admin user with strong password before exposing MongoDB
  • Bind to localhost or use VPC/firewall rules
  • Use TLS for connections

zakirkun/ice-tea/tree/main/skills/database/mongodb-no-auth commit a0e17077b7

Frequently asked questions

npx skillmds@latest add zakirkun/mongodb-without-authentication