google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
860 stars 178 forks source link

PRP: Unauthenticated Mongodb server #479

Open am0o0 opened 1 month ago

am0o0 commented 1 month ago

MongoDB doesn't enable auth by default, so the possibility of accidentally exposing a MongoDB is high. I don't think checking with RCE is possible, but we can check access easily with MongoDB java driver.