Skip to content
HackIndex logo

HackIndex

MongoDB Server Configuration and Environment Enumeration

3 min read Mar 28, 2026

Server configuration enumeration establishes why access was possible in the first place. The startup options reveal whether auth is disabled, which interfaces MongoDB binds to, and whether TLS is enforced. Host info reveals the OS and kernel version. All of this feeds directly into dangerous configuration checks. Run these commands after confirming unauthenticated or authenticated access via service discovery.

Startup Options and Security Configuration

getCmdLineOpts returns the exact arguments MongoDB was started with. This is the fastest way to confirm auth is disabled and see the bind address:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts: 1}))' 
{
  argv: [ 'mongod', '--bind_ip_all', '--port', '27017', '--noauth' ],
  parsed: {
    net: { bindIp: '*', port: 27017 },
    security: { authorization: 'disabled' }
  },
  ok: 1
}

--bind_ip_all and authorization: disabled together confirm the worst-case configuration: MongoDB is reachable from any IP and requires no credentials. --noauth is the legacy flag equivalent to disabling authorization.

Check Authorization State Directly

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts: 1}).parsed.security)' 
{ authorization: 'disabled' }

Version and Build Information

The exact version determines which CVEs apply. Check against the MongoBleed affected version table:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.serverBuildInfo())' 
{
  version: '6.0.5',
  javascriptEngine: 'mozjs',
  openssl: { running: 'OpenSSL 3.0.2', compiled: 'OpenSSL 3.0.2' },
  bits: 64,
  ok: 1
}

Note whether javascriptEngine is present — it indicates the server-side JavaScript engine is active, which is required for $where operator injection attacks covered in operator injection.

Host and OS Information

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.hostInfo())' 
{
  system: {
    hostname: 'db-server-01',
    cpuAddrSize: 64,
    memSizeMB: 7837,
    numCores: 8
  },
  os: { type: 'Linux', name: 'Ubuntu', version: '20.04' },
  extra: { kernelVersion: '5.15.0-91-generic' },
  ok: 1
}

The hostname often matches a resolvable internal DNS name. The OS and kernel version inform privilege escalation paths after gaining shell access through the database.

Runtime Status

serverStatus gives active connection count, uptime, and memory usage. Useful for understanding the load and impact of actions on a production instance:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.serverStatus())' | head -30 
{
  host: 'db-server-01',
  version: '6.0.5',
  uptime: 86400,
  connections: { current: 5, available: 838855, totalCreated: 42 },
  ok: 1
}

TLS Configuration Check

Confirm whether TLS is enforced or whether the connection is plaintext — relevant for credential interception on the network path:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts: 1}).parsed.net)' 
{ bindIp: '*', port: 27017 }

No tls key in the net configuration confirms plaintext connections. A tls.mode of disabled or allowTLS also means plaintext is accepted. Only requireTLS enforces encryption on all connections.

References