Detections
Analytics

MD8X-00-003350 - MongoDB must be configured to restrict the use of administrator access to authorized IP addresses.

Information

MongoDB will use Authentication Restrictions to enforce network-based separation of admin users from application users on the same port.

With Authentication Restrictions, the database can be configured to specify a list of IP addresses and CIDR ranges from which a user is allowed to connect to the server or from which the server can accept users.

Authentication Restrictions addresses the following:
- Network-based Separation: Admin users are restricted to connecting only from designated admin networks/IPs, while application users are restricted to the application subnet.
- Unauthorized Access Mitigation: Even if credentials are compromised, connections are blocked from unauthorized networks at the authentication level, leaving no chance for bypass.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

For all administrative users that do not have network restrictions configured, use the following command:

use admin
db.updateUser( "<username>", { authenticationRestrictions: [ { clientSource: [ "<ip_or_cidr>", serverAddress: ["<ip_or_cidr>"] } ] })

Run the following command to set to local host:

use admin
db.updateUser("<username>", { authenticationRestrictions: [ { clientSource: ["127.0.0.1"], serverAddress: ["127.0.0.1"] } ] })

More information can be found here:
https://www.mongodb.com/docs/manual/reference/command/createUser/#authentication-restrictions

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MDB_Enterprise_Advanced_8-x_V1R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b., CAT|II, CCI|CCI-000382, Rule-ID|SV-282943r1179530_rule, STIG-ID|MD8X-00-003350, Vuln-ID|V-282943

Plugin: MongoDB

Control ID: 19a144883d5360859e4d1de50b8790464f0a61f3146ef554fa3f6c20d3d0199d