MongoDB remote command execution vulnerability: nightmare or eye opener?
blog.sdelements.com
MongoDB remote command execution vulnerability: nightmare or eye opener?
1–10 of 28 posts
Re: MongoDB remote command execution vulnerability: nightmare or eye opener?
#2Doesn't the MongoDB daemon run in a privilege-free sandboxed environment?
Re: MongoDB remote command execution vulnerability: nightmare or eye opener?
#3Doesn't the MongoDB daemon run in a privilege-free sandboxed environment?
Depends who's running it. :)
Re: MongoDB remote command execution vulnerability: nightmare or eye opener?
#4Doesn't the MongoDB daemon run in a privilege-free sandboxed environment?
MongoDB manual has some good recommendations on operations here: http://docs.mongodb.org/manual/administration/security/#oper...
It certainly helps limit the damage. However, unless it is chroot-ed, it will still pose a very serious risk. And even with chroot, the damage is not totally eliminated. The attacker can start leveraging local vulnerabilities.
Re: MongoDB remote command execution vulnerability: nightmare or eye opener?
#5As a developer that uses MongoDB in production I am shocked! Shocked, I tell you.
Re: MongoDB remote command execution vulnerability: nightmare or eye opener?
#6I guess this is only a real problem if you're exposing your MongoDB instance to the internet.
Re: MongoDB remote command execution vulnerability: nightmare or eye opener?
#7This relies on javascript to be passed to $where. There is no excuse for not sanitizing your inputs.
Re: MongoDB remote command execution vulnerability: nightmare or eye opener?
#8As a developer that uses MongoDB in production I am shocked! Shocked, I tell you.
And why are you shocked? Because you don't know what you are doing?