# MongoDB Server Configuration and Environment Enumeration

- **URL:** https://hackindex.io/services/mongodb/enumeration/mongodb-server-configuration-and-environment-enumeration
- **Path:** MongoDB > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/mongodb/enumeration.md)
- **Published:** 2025-12-29
- **Updated:** 2026-03-28

Server configuration enumeration establishes why access was possible in the first place. The startup options reveal whether auth is disabled, which interfaces MongoDB binds to, and whether TLS is enforced. Host info reveals the OS and kernel version. All of this feeds directly into [dangerous configuration checks](https://hackindex.io/services/mongodb/vulnerability-discovery/mongodb-dangerous-configuration-checks). Run these commands after confirming unauthenticated or authenticated access via [service discovery](https://hackindex.io/services/mongodb/enumeration/mongodb-service-discovery-and-access-validation).

## MongoDB configuration enumeration: startup options

getCmdLineOpts returns the exact arguments MongoDB was started with. This is the fastest way to confirm auth is disabled and see the bind address:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts: 1}))'
# {
#   argv: [ 'mongod', '--bind_ip_all', '--port', '27017', '--noauth' ],
#   parsed: {
#     net: { bindIp: '*', port: 27017 },
#     security: { authorization: 'disabled' }
#   },
#   ok: 1
# }
```

`--bind_ip_all` and `authorization: disabled` together confirm the worst-case configuration: MongoDB is reachable from any IP and requires no credentials. `--noauth` is the legacy flag equivalent to disabling authorization.

## Check Authorization State Directly

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts: 1}).parsed.security)'
# { authorization: 'disabled' }
```

## Version and Build Information

The exact version determines which CVEs apply. Check against the [MongoBleed affected version table](https://hackindex.io/services/mongodb/exploitation/mongodb-cve-2025-14847-mongobleed):

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.serverBuildInfo())'
# {
#   version: '6.0.5',
#   javascriptEngine: 'mozjs',
#   openssl: { running: 'OpenSSL 3.0.2', compiled: 'OpenSSL 3.0.2' },
#   bits: 64,
#   ok: 1
# }
```

Note whether `javascriptEngine` is present: it indicates the server-side JavaScript engine is active, which is required for `$where` operator injection attacks covered in [operator injection](https://hackindex.io/services/mongodb/exploitation/mongodb-operator-injection).

## Host and OS Information

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.hostInfo())'
# {
#   system: {
#     hostname: 'db-server-01',
#     cpuAddrSize: 64,
#     memSizeMB: 7837,
#     numCores: 8
#   },
#   os: { type: 'Linux', name: 'Ubuntu', version: '20.04' },
#   extra: { kernelVersion: '5.15.0-91-generic' },
#   ok: 1
# }
```

The hostname often matches a resolvable internal DNS name. The OS and kernel version inform privilege escalation paths after gaining shell access through the database.

## Runtime Status

serverStatus gives active connection count, uptime, and memory usage. Useful for understanding the load and impact of actions on a production instance:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.serverStatus())' | head -30
# {
#   host: 'db-server-01',
#   version: '6.0.5',
#   uptime: 86400,
#   connections: { current: 5, available: 838855, totalCreated: 42 },
#   ok: 1
# }
```

## TLS Configuration Check

Confirm whether TLS is enforced or whether the connection is plaintext: relevant for credential interception on the network path:

```bash
mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts: 1}).parsed.net)'
# { bindIp: '*', port: 27017 }
```

TLS mode interpretation:

- No `tls` key in net configuration: plaintext connections
- `tls.mode: disabled` or `allowTLS`: plaintext is accepted
- `tls.mode: preferTLS`: TLS preferred but not enforced
- `tls.mode: requireTLS`: encryption enforced on all connections

## References

- [MongoDB: getCmdLineOpts](https://www.mongodb.com/docs/manual/reference/command/getCmdLineOpts/) - Startup arguments including auth, bind address, and TLS configuration
- [MongoDB: serverStatus](https://www.mongodb.com/docs/manual/reference/command/serverStatus/) - Runtime diagnostics including connections, memory, and operation counters