Password in MongoDB Connection String
ID |
mongodb_connection_string |
Severity |
high |
Vendor |
MongoDB |
Family |
Data Storage Secret |
Description
MongoDB is a popular NoSQL database system, optimized for storing JSON documents.
It uses a connection string to connect to the database. Connection strings are used in connections between MongoDB instances and applications (via database drivers) or with tools like MongoDB Compass and the MongoDB Shell (mongosh).
As (username, password) pair are the most common authentication credentials used in MongoDB, connection strings often include them, following the usual schema protocol://username:password@hostname used in URLs. In the case of MongoDB, the password is stored in variants of the mongodb://username:password@host URI scheme.
Security
Leaking a MongoDB connection string with a password can have serious security implications, allowing immediate unauthorized access to the MongoDB database with the permissions of the user. That could lead to data theft, data manipulation, or even data loss.
Mitigation / Fix
If a MongoDB connection string containing a password is leaked, you should immediately rotate the password, and change the connection string with hardcoded passwords with a safer way using environment variables. For example:
mongodb+srv://${MONGO_USER}:${MONGO_PASSWORD}@server.example.com/
Follow the instructions for self-managed deployments, using the changeUserPassword mongosh method, or the updateUser database command.
You could then audit the affected MongoDB databases for any signs of unauthorized access or manipulation.
If under a git repository, you may remove unwanted files from the repository history using tools like git filter-repo or BFG Repo-Cleaner. You may follow the procedure listed here for GitHub.
|
You should consider any sensitive data in commits with secrets as compromised. Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories. |