[Reproduced works]MongoDB Unauthorized Access Vulnerability

mongodb未授权访问漏洞

catalogue

1. mongodb安装
2. 未授权访问漏洞
3. 漏洞修复及加固
4. 自动化检测点

1. mongodb安装

apt-get install mongodb

0x1: 创建数据库目录

MongoDB的数据存储在data目录的db目录下，但是这个目录在安装过程不会自动创建，所以你需要手动创建data目录，并在data目录中创建db目录。/data/db 是 MongoDB 默认的启动的数据库路径(--dbpath)

mkdir -p /data/db

0x2: 命令行中运行 MongoDB 服务

注意: 如果你的数据库目录不是/data/db，可以通过 --dbpath 来指定

0x3: MongoDB后台管理 Shell

如果你需要进入MongoDB后台管理，你需要先打开mongodb装目录的下的bin目录，然后执行mongo命令文件。MongoDB Shell是MongoDB自带的交互式Javascript shell,用来对MongoDB进行操作和管理的交互式环境。当你进入mongoDB后台后，它默认会链接到 test 文档(数据库)

[email protected]:~# mongo
MongoDB shell version: 2.4.9
connecting to: test
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
    http://docs.mongodb.org/
Questions? Try the support group
    http://groups.google.com/group/mongodb-user
>

现在让我们插入一些简单的数据，并对插入的数据进行检索

> db.runoob.insert({x:10})
> db.runoob.find()
{ "_id" : ObjectId("586df25ead93a0064a40a3ae"), "x" : 10 }
>

0x4: MongoDb web 用户界面

MongoDB 提供了简单的 HTTP 用户界面。 如果你想启用该功能，需要在启动的时候指定参数 --rest

./mongod --dbpath=/data/db --rest

MongoDB 的 Web 界面访问端口比服务的端口多1000 如果你的MongoDB运行端口使用默认的27017，你可以在端口号为28017访问web用户界面，即地址为：http://localhost:28017

Relevant Link:

http://www.runoob.com/mongodb/mongodb-linux-install.html

2. 未授权访问漏洞

开启MongoDB服务时不添加任何参数时,默认是没有权限验证的,登录的用户可以通过默认端口无需密码对数据库任意操作(增删改高危动作)而且可以远程访问数据库

0x1: 漏洞成因

在刚安装完毕的时候MongoDB都默认有一个admin数据库,此时admin数据库是空的,没有记录权限相关的信息！当admin.system.users一个用户都没有时，即使mongod启动时添加了—auth参数,如果没有在admin数据库中添加用户,此时不进行任何认证还是可以做任何操作(不管是否是以—auth 参数启动),直到在admin.system.users中添加了一个用户。加固的核心是只有在admin.system.users中添加用户之后，mongodb的认证,授权服务才能生效

Relevant Link:

https://www.secpulse.com/archives/27090.html
http://webscan.360.cn/vul/view/vulid/3558

3. 漏洞修复及加固

0x1: 修改默认端口

修改默认的mongoDB端口(默认为: TCP 27017)为其他端口

0x2: 不要开放到公网0.0.0.0

vim /etc/mongodb.conf
bind_ip = 127.0.0.1

和redis一样，mongodb最好只开放本地监听，至少不能是0.0.0.0

0x3: 禁用HTTP和REST端口

MongoDB自身带有一个HTTP服务和并支持REST接口。在2.6以后这些接口默认是关闭的。mongoDB默认会使用默认端口监听web服务，一般不需要通过web方式进行远程管理，建议禁用。修改配置文件或在启动的时候选择–nohttpinterface 参数nohttpinterface = false

0x4: 开启日志审计功能

审计功能可以用来记录用户对数据库的所有相关操作。这些记录可以让系统管理员在需要的时候分析数据库在什么时段发生了什么事情

0x5: 开启MongoDB授权

在admin 数据库中创建用户，如 supper 密码为 sup(此处均为举例说明，请勿使用此账号密码)

> use admin
switched to db admin
> db.addUser("supper", "sup")
{
    "user" : "supper",
    "readOnly" : false,
    "pwd" : "f4e451395b5b554788c796e5488573b2",
    "_id" : ObjectId("586dfb12ad93a0064a40a3af")
}
> db.auth("supper","sup")
1
> exit
bye

修改配置文件

vim /etc/mongodb.conf
auth = true

Relevant Link:

https://laravel-china.org/topics/328
https://help.aliyun.com/knowledge_detail/37451.html

4. 自动化检测点

0x1: 检测是否监听到127.0.0.1

不管是配置文件里的，还是命令行参数里的，只要最终结果不是127.0.0.1，就认为是不安全的

--bind_ip 127.0.0.1
or
vim /etc/mongodb.conf
bind_ip = 127.0.0.1

0x2: 检测是否开启auth认证

mongod --auth
or
vim /etc/mongodb.conf
auth = true

via

*:first-child {
margin-top: 0 !important;
}

body>*:last-child {
margin-bottom: 0 !important;
}

/* BLOCKS
=============================================================================*/

p, blockquote, ul, ol, dl, table, pre {
margin: 15px 0;
}

/* HEADERS
=============================================================================*/

h1, h2, h3, h4, h5, h6 {
margin: 20px 0 10px;
padding: 0;
font-weight: bold;
-webkit-font-smoothing: antialiased;
}

h1 tt, h1 code, h2 tt, h2 code, h3 tt, h3 code, h4 tt, h4 code, h5 tt, h5 code, h6 tt, h6 code {
font-size: inherit;
}

h1 {
font-size: 28px;
color: #000;
}

h2 {
font-size: 24px;
border-bottom: 1px solid #ccc;
color: #000;
}

h3 {
font-size: 18px;
}

h4 {
font-size: 16px;
}

h5 {
font-size: 14px;
}

h6 {
color: #777;
font-size: 14px;
}

body>h2:first-child, body>h1:first-child, body>h1:first-child+h2, body>h3:first-child, body>h4:first-child, body>h5:first-child, body>h6:first-child {
margin-top: 0;
padding-top: 0;
}

a:first-child h1, a:first-child h2, a:first-child h3, a:first-child h4, a:first-child h5, a:first-child h6 {
margin-top: 0;
padding-top: 0;
}

h1+p, h2+p, h3+p, h4+p, h5+p, h6+p {
margin-top: 10px;
}

/* LINKS
=============================================================================*/

a {
color: #4183C4;
text-decoration: none;
}

a:hover {
text-decoration: underline;
}

/* LISTS
=============================================================================*/

ul, ol {
padding-left: 30px;
}

ul li > :first-child,
ol li > :first-child,
ul li ul:first-of-type,
ol li ol:first-of-type,
ul li ol:first-of-type,
ol li ul:first-of-type {
margin-top: 0px;
}

ul ul, ul ol, ol ol, ol ul {
margin-bottom: 0;
}

dl {
padding: 0;
}

dl dt {
font-size: 14px;
font-weight: bold;
font-style: italic;
padding: 0;
margin: 15px 0 5px;
}

dl dt:first-child {
padding: 0;
}

dl dt>:first-child {
margin-top: 0px;
}

dl dt>:last-child {
margin-bottom: 0px;
}

dl dd {
margin: 0 0 15px;
padding: 0 15px;
}

dl dd>:first-child {
margin-top: 0px;
}

dl dd>:last-child {
margin-bottom: 0px;
}

/* CODE
=============================================================================*/

pre, code, tt {
font-size: 12px;
font-family: Consolas, "Liberation Mono", Courier, monospace;
}

code, tt {
margin: 0 0px;
padding: 0px 0px;
white-space: nowrap;
border: 1px solid #eaeaea;
background-color: #f8f8f8;
border-radius: 3px;
}

pre>code {
margin: 0;
padding: 0;
white-space: pre;
border: none;
background: transparent;
}

pre {
background-color: #f8f8f8;
border: 1px solid #ccc;
font-size: 13px;
line-height: 19px;
overflow: auto;
padding: 6px 10px;
border-radius: 3px;
}

pre code, pre tt {
background-color: transparent;
border: none;
}

kbd {
-moz-border-bottom-colors: none;
-moz-border-left-colors: none;
-moz-border-right-colors: none;
-moz-border-top-colors: none;
background-color: #DDDDDD;
background-image: linear-gradient(#F1F1F1, #DDDDDD);
background-repeat: repeat-x;
border-color: #DDDDDD #CCCCCC #CCCCCC #DDDDDD;
border-image: none;
border-radius: 2px 2px 2px 2px;
border-style: solid;
border-width: 1px;
font-family: "Helvetica Neue",Helvetica,Arial,sans-serif;
line-height: 10px;
padding: 1px 4px;
}

/* QUOTES
=============================================================================*/

blockquote {
border-left: 4px solid #DDD;
padding: 0 15px;
color: #777;
}

blockquote>:first-child {
margin-top: 0px;
}

blockquote>:last-child {
margin-bottom: 0px;
}

/* HORIZONTAL RULES
=============================================================================*/

hr {
clear: both;
margin: 15px 0;
height: 0px;
overflow: hidden;
border: none;
background: transparent;
border-bottom: 4px solid #ddd;
padding: 0;
}

/* TABLES
=============================================================================*/

table th {
font-weight: bold;
}

table th, table td {
border: 1px solid #ccc;
padding: 6px 13px;
}

table tr {
border-top: 1px solid #ccc;
background-color: #fff;
}

table tr:nth-child(2n) {
background-color: #f8f8f8;
}

/* IMAGES
=============================================================================*/

img {
max-width: 100%
}
-->

时间： 2024-11-04 06:55:23

[Reproduced works]MongoDB Unauthorized Access Vulnerability的相关文章

401 - Unauthorized: Access is denied due to invalid

使用Windows集成验证,不管使用IIS还是IIS express,当同一个域进行访问时,可能出现401错误,错误的处理办法: 1. IIS(摘自MSDN的) IIS 7 was difficult for figuring out why i was getting the 401 - Unauthorized: Access is denied due to invalid credentials... until i did this... 1.) Open IIS and select

Lync 2013 Unauthorized: Access is denied due to a RBAC authorization Failure

今天安装Lync 2013, 全部都做完了,但是打开Lync控制台的时候用域管理员不能登录了.报错: Unauthorized: Access is denied due to a RBAC authorization Failure , 如下图, 修改了关于SQL的一些权限都不行.最终发现将administrator加入到CSadministrators这个组里就可以了. 微软官方也有相应的解说 https://technet.microsoft.com/zh-CN/library/gg413

401 - Unauthorized: Access is denied due to invalid credentials.

solution:change application pool from ApplicationPoolIdentity to NetworkService.

Oracle Applications Multiple Organizations Access Control for Custom Code

文档 ID 420787.1 White Paper Oracle Applications Multiple Organizations Access Control for Custom Code Checked for relevance on 12-JAN-2011 See Change Record This document discusses how to update the customization code that is affected by the access co

A GUIDE TO UNDERSTANDINGDISCRETIONARY ACCESS CONTROL INTRUSTED SYSTEMS

1. INTRODUCTION ? The main goal of the National Computer Security Center is to encourage the widespread availability of trusted computer systems. In support of that goal a metric was created, the Department of Defense Trusted Computer System Evaluati

Access control differentiation in trusted computer system

A trusted computer system that offers Linux? compatibility and supports contemporary hardware speeds. It is designed to require no porting of common applications which run on Linux, to be easy to develop for, and to allow the use of a wide variety of

CISSP AIO 3th: Access Control

This chapter presents the following: • Identification methods and technologies • Authentication methods, models, and technologies • Discretionary, mandatory, and nondiscretionary models • Accountability, monitoring, and auditing practices • Emanation

MongoDB的内置角色 Built-In Roles

关于芒果的权限控制说白了就是定义 Role(角色) 来控制对数据库进行的操作(调用的方法比如查询方法find). 系统内置的Role分为 以下几大类: Database User Roles 这个是针对非系统数据库和部分系统表的角色组 Database Administration Roles 可以操作所有数据库 Cluster Administration Roles 管理员族 针对整个系统进行管理 Backup and Restoration Roles 备份还原角色组 All-Databa

Dynamics AX 2012 R2 IIS WebSite Unauthorized 401

    今天,Reinhard部署好Aif Customer Service ,打开http://host:port/MicrosoftDynamicsAXAif60/,发现提示以下错误: 401 - Unauthorized: Access is denied due to invalid credentials 401 - 未授权: 由于凭据无效,访问被拒绝. 您无权使用所提供的凭据查看此目录或页面.     我们都知道,AX使用的Windows Authentication方式.出现上面的