Skip to content
HackIndex logo

HackIndex

MongoDB Dangerous Configuration Checks

3 min read Mar 28, 2026

MongoDB misconfigurations are responsible for the majority of exposed instances found in the wild. Disabled authorization and wildcard bind addresses together produce fully open databases reachable from the internet. Each configuration item below is an independent finding. Run these after gaining access through service discovery and use results to inform the full attack path.

Authorization Disabled

The most critical misconfiguration. Pull the startup options and check the security configuration:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts:1}).parsed.security)' 
{ authorization: 'disabled' }
┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts:1}).argv)' | grep -iE 'noauth|auth' 
"--noauth"

authorization: disabled or --noauth in argv confirms authentication is off. Any client connecting to this instance has full access to all databases and collections.

Wildcard Bind Address

MongoDB bound to 0.0.0.0 or * accepts connections from any IP address. Combined with disabled auth this means any host on the internet can connect:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts:1}).parsed.net)' 
{ bindIp: '*', port: 27017 }

bindIp: '*' or 0.0.0.0 confirms the instance listens on all interfaces. A correctly configured instance should bind only to 127.0.0.1 or a specific internal interface. The --bind_ip_all startup flag produces the same result.

TLS Not Enforced

Without TLS, all data including credentials transmitted during authentication is plaintext on the wire:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getCmdLineOpts:1}).parsed.net)' | grep -i tls

No tls key in the net configuration output confirms TLS is not configured. A correctly hardened instance should have tls.mode: requireTLS. Confirm by attempting a plain connection — if it succeeds, TLS is not enforced:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'db.version()' 2>/dev/null && echo 'plaintext accepted' 
6.0.5
plaintext accepted

JavaScript Execution Enabled

The server-side JavaScript engine enables the $where operator, which executes arbitrary JavaScript in query context. This is required for operator injection attacks using $where. Check whether it is active:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.adminCommand({getParameter:1, javascriptEnabled:1}))' 
{ javascriptEnabled: true, ok: 1 }

javascriptEnabled: true confirms $where queries will execute. This is also visible in the build info as javascriptEngine: mozjs. In MongoDB 4.4 and later, JavaScript execution is disabled by default with --noscripting — finding it enabled is a misconfiguration finding.

HTTP Interface and REST API

Older MongoDB versions (pre-3.6) exposed an HTTP diagnostic interface on port 28017. Check whether it is accessible:

┌──(kali㉿kali)-[~]
└─$ curl -sk http://$TARGET_IP:28017/ | grep -i 'mongodb\|version\|databases'

Configuration Summary Check

Run all checks in a single non-interactive pass for documentation and reporting:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval '
var opts = db.adminCommand({getCmdLineOpts:1});
var params = db.adminCommand({getParameter:1, javascriptEnabled:1});
print("Version: "+db.version());
print("BindIP: "+(opts.parsed.net ? opts.parsed.net.bindIp : "unknown"));
print("Auth: "+(opts.parsed.security ? opts.parsed.security.authorization : "unknown"));
print("TLS: "+(opts.parsed.net && opts.parsed.net.tls ? opts.parsed.net.tls.mode : "not configured"));
print("JavaScript: "+params.javascriptEnabled);
' 
Version: 6.0.5
BindIP: *
Auth: disabled
TLS: not configured
JavaScript: true

References