Approximately 40,000 businesses and organizations that use high-performance, NoSQL, MongoDB databases are unprotected and vulnerable to hacking.
Three researchers from Saarland University in Germany – Eric Petryka, Kai Greshake and Jens Heyens – discovered that MongoDB databases running on TCP port 27017, and used as a service on tens of thousands of commercial web servers, are easily accessible over the internet.
[alert variation=”alert-info”]MongoDB is a commercially reliable open source database, used by companies across all industries for a wide variety of applications.[/alert]
German researchers said they were able to easily gain “read and write access” to unsecured MongoDB databases without the use of special hacking tools.
A total of 39,890 vulnerable databases were identified, including a database belonging to a well-known French telecommunications company containing 8 million customer phone numbers and addresses. The company's name has not been disclosed.
“Anyone could retrieve, and even change, millions of customer data records, including names, email addresses and credit card numbers,” the Saarland University reports.
Exploiting the vulnerability is incredibly easy, as all an attacker needs to do is run a port scan for TCP port 27017 on the victim's computer, while finding all potentially vulnerable servers on the Internet could be achieved within four hours, by scanning the Internet using a faster TCP Port Scanner called "masscan".
The German researchers reported the issue to MongoDB, as well as the French Data Protection Authority (CNIL) and the Federal Office for Information Security, so that affected database owners could be informed of the vulnerability.
