Skip to content

Latest commit

 

History

History
84 lines (73 loc) · 6.9 KB

threat-modeling.md

File metadata and controls

84 lines (73 loc) · 6.9 KB

Threat Model Analysis for mongodb/mongo

Threat: NoSQL Injection

  • Threat: NoSQL Injection
    • Description: An attacker crafts malicious input that, when incorporated into a MongoDB query without proper sanitization or parameterization, alters the query's intended logic. The attacker leverages MongoDB query operators (e.g., $where, $regex, $gt, $ne) within the input to bypass authentication, access unauthorized data, or, in some configurations, execute server-side JavaScript. This occurs when the application constructs BSON documents using string concatenation instead of the driver's BSON building functions.
    • Impact:
      • Data breach: Unauthorized access to sensitive data.
      • Data modification: Unauthorized alteration or deletion of data.
      • Data exfiltration: Copying of sensitive data.
      • Potential server-side code execution (depending on server configuration and injection specifics).
    • MongoDB Component Affected:
      • mongo.Collection.Find(), mongo.Collection.FindOne(), mongo.Collection.UpdateOne(), mongo.Collection.UpdateMany(), mongo.Collection.DeleteOne(), mongo.Collection.DeleteMany(), mongo.Collection.Aggregate(), and any other functions that accept a query filter (BSON document) as input. The core vulnerability is in the application's incorrect BSON construction.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Primary: Use BSON Builders: Always use the Go driver's BSON document builders (bson.D, bson.M, bson.E, bson.A). Never concatenate user input into query strings. The driver handles escaping and type safety.
      • Input Validation: Validate all user input before use in database operations (data types, lengths, allowed characters). This is a secondary defense.
      • Schema Validation (Server-Side): Use MongoDB's schema validation for data integrity at the database level.

Threat: Connection String Injection / Manipulation

  • Threat: Connection String Injection / Manipulation
    • Description: An attacker gains control over the connection string used by the Go driver. This often happens if the connection string is read from an untrusted source (e.g., a modifiable configuration file, user input, or an insecure environment variable). The attacker could redirect the connection to a malicious MongoDB server or inject unauthorized credentials.
    • Impact:
      • Data breach: The attacker's rogue server receives all data.
      • Data modification: The attacker can modify data sent to their server.
      • Denial of Service: The application cannot connect to the legitimate database.
    • MongoDB Component Affected:
      • mongo.Connect(): Establishes the initial connection.
      • options.ClientOptions.ApplyURI(): Parses the connection string.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Secure Configuration: Store the connection string in a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager). Never hardcode it.
      • Environment Variables (with Caution): If using environment variables, ensure they are securely set and inaccessible to unauthorized users.
      • Input Validation (if applicable): If any part of the connection string comes from user input (avoid this), rigorously validate it.
      • Least Privilege (Database User): The database user in the connection string should have minimal permissions.

Threat: Denial of Service via Connection Exhaustion

  • Threat: Denial of Service via Connection Exhaustion
    • Description: The application fails to manage MongoDB connections properly, depleting the connection pool. Causes include connection leaks (not closing connections), excessive concurrent connections, and long-running operations without context management.
    • Impact:
      • Denial of Service: The application cannot connect to the database.
    • MongoDB Component Affected:
      • mongo.Connect(): Establishes connections.
      • mongo.Client.Disconnect(): Closes connections.
      • Internal connection pooling mechanisms (configurable via options.ClientOptions).
    • Risk Severity: High
    • Mitigation Strategies:
      • Proper Disconnect() Usage: Always call client.Disconnect(ctx) when finished with a client, even on errors. Use defer.
      • Context Management: Use context.Context to control operation lifetimes. Cancel the context to release connections.
      • Connection Pool Configuration: Tune connection pool settings (MaxPoolSize, MinPoolSize, MaxConnIdleTime) in options.ClientOptions.
      • Monitoring: Monitor connection usage to detect leaks or excessive creation.

Threat: Unencrypted Communication (Missing TLS/SSL)

  • Threat: Unencrypted Communication (Missing TLS/SSL)
    • Description: The application connects to MongoDB without TLS/SSL, or with improperly configured TLS/SSL (e.g., disabling certificate verification). This allows an attacker to intercept network traffic.
    • Impact:
      • Data breach: Eavesdropping on all data, including credentials.
      • Data modification: Potential modification of data in transit.
    • MongoDB Component Affected:
      • mongo.Connect(): The connection process.
      • options.ClientOptions.SetTLSConfig(): Configures TLS/SSL.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Enforce TLS/SSL: Always use TLS/SSL (tls=true in the connection string).
      • Strong Certificate Verification: Never disable certificate verification. Use a trusted CA.
      • Configure TLS Options: Use options.ClientOptions.SetTLSConfig() for proper TLS settings (CA certificate, client certificate if needed, allowed TLS versions/ciphers).

Threat: Outdated Driver Version

  • Threat: Outdated Driver Version
    • Description: The application uses an outdated MongoDB Go driver with known security vulnerabilities.
    • Impact:
      • Varies depending on the vulnerability: Could range from DoS to arbitrary code execution.
    • MongoDB Component Affected:
      • The entire driver.
    • Risk Severity: High (potentially Critical, depending on the vulnerability)
    • Mitigation Strategies:
      • Regular Updates: Keep the driver updated to the latest stable version.
      • Dependency Management: Use Go modules (go.mod) to manage dependencies.
      • Vulnerability Scanning: Use tools to identify vulnerable dependencies.