Unrestricted MongoDB Access Should Not Be Allowed

Using Console

To remediate the unrestricted MongoDB access issue in AWS, you can follow these steps:

Open the AWS Management Console and navigate to the EC2 dashboard.
Select the Security Groups option from the left-hand menu.
Find the security group associated with the MongoDB instance that you want to restrict access to.
Click on the security group to open the details page.
Select the Inbound Rules tab.
Locate the rule that allows unrestricted access to MongoDB (default port 27017).
Click on the “Edit” button next to the rule.
Change the Source field to restrict access to only the IP addresses or CIDR ranges that require access to the MongoDB instance.
Click “Save” to apply the changes.

By following these steps, you have successfully remediated the unrestricted MongoDB access issue in AWS by restricting access to only authorized IP addresses or CIDR ranges.

Using CLI

To remediate unrestricted MongoDB access in AWS using AWS CLI, follow the below steps:

Open the AWS CLI on your local machine.
Run the following command to list all the MongoDB instances running in your AWS account:

aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,Engine]' --filters "Name=engine,Values=mongodb"

Identify the MongoDB instances that have unrestricted access.
Run the following command to modify the security group associated with the MongoDB instance to allow access only from specific IP addresses:

aws rds modify-db-instance --db-instance-identifier <db-instance-identifier> --vpc-security-group-ids <security-group-id>

Note: Replace <db-instance-identifier> with the identifier of the MongoDB instance and <security-group-id> with the ID of the security group that allows access only from specific IP addresses. 5. Verify the changes by running the following command:

aws rds describe-db-instances --db-instance-identifier <db-instance-identifier> --query 'DBInstances[*].[DBInstanceIdentifier,VpcSecurityGroups[0].VpcSecurityGroupId]'

Note: Replace <db-instance-identifier> with the identifier of the MongoDB instance.After these steps, the MongoDB instance will only allow access from specific IP addresses.

Using Python

To remediate unrestricted MongoDB access in AWS using Python, you can follow these steps:

Identify the MongoDB instances running in your AWS environment.
For each instance, check if the security group associated with it allows unrestricted access to the MongoDB port (default port is 27017).
If the security group allows unrestricted access, update the security group to restrict access to the MongoDB port to only the necessary IP addresses or CIDR ranges.
You can use the boto3 library in Python to interact with the AWS API and perform the above steps.

Here’s a sample Python code that can help you remediate the issue:

import boto3

# Initialize the AWS client
client = boto3.client('ec2')

# Get a list of all MongoDB instances
response = client.describe_instances(
    Filters=[
        {
            'Name': 'tag:Name',
            'Values': ['*mongodb*']
        }
    ]
)

# Loop through each instance and update its security group
for reservation in response['Reservations']:
    for instance in reservation['Instances']:
        for sg in instance['SecurityGroups']:
            # Check if the security group allows unrestricted access to MongoDB port
            ip_permissions = sg['IpPermissions']
            unrestricted_access = False
            for permission in ip_permissions:
                if permission['IpProtocol'] == 'tcp' and permission['FromPort'] == 27017 and permission['ToPort'] == 27017:
                    for ip_range in permission['IpRanges']:
                        if ip_range['CidrIp'] == '0.0.0.0/0':
                            unrestricted_access = True
                            break
            
            # If unrestricted access is allowed, update the security group
            if unrestricted_access:
                response = client.authorize_security_group_ingress(
                    GroupId=sg['GroupId'],
                    IpPermissions=[
                        {
                            'IpProtocol': 'tcp',
                            'FromPort': 27017,
                            'ToPort': 27017,
                            'IpRanges': [
                                {
                                    'CidrIp': '10.0.0.0/8' # Replace with the necessary IP addresses or CIDR ranges
                                }
                            ]
                        }
                    ]
                )
                print(response)

Note: This is just a sample code and may need to be modified based on your specific AWS environment and requirements. It’s recommended to test the code in a non-production environment before applying it to your production environment.

Using Terraform

# Existing security group (example)
resource "aws_security_group" "mongodb_sg" {
  name        = "mongodb-sg"
  description = "Security group for MongoDB"
  vpc_id      = aws_vpc.MY_VPC.id
}

# REMOVE any existing aws_vpc_security_group_ingress_rule (or inline ingress)
# that has:
#   from_port = 27017
#   to_port   = 27017
#   ip_protocol = "tcp"
#   cidr_ipv4 = "0.0.0.0/0"   or   cidr_ipv6 = "::/0"
#
# Example of a BAD rule that must be deleted from your Terraform:
#
# resource "aws_vpc_security_group_ingress_rule" "mongo_unrestricted_ipv4" {
#   security_group_id = aws_security_group.mongodb_sg.id
#   ip_protocol       = "tcp"
#   from_port         = 27017
#   to_port           = 27017
#   cidr_ipv4         = "0.0.0.0/0"
# }
#
# resource "aws_vpc_security_group_ingress_rule" "mongo_unrestricted_ipv6" {
#   security_group_id = aws_security_group.mongodb_sg.id
#   ip_protocol       = "tcp"
#   from_port         = 27017
#   to_port           = 27017
#   cidr_ipv6         = "::/0"
# }

# OPTIONAL: replace with more restrictive IPv4 access
resource "aws_vpc_security_group_ingress_rule" "mongo_restricted_ipv4" {
  security_group_id = aws_security_group.mongodb_sg.id

  ip_protocol = "tcp"
  from_port   = 27017
  to_port     = 27017

  cidr_ipv4 = "ALLOWED_IPV4_CIDR" # e.g. "203.0.113.10/32" for a known admin IP
}

# OPTIONAL: replace with more restrictive IPv6 access
resource "aws_vpc_security_group_ingress_rule" "mongo_restricted_ipv6" {
  security_group_id = aws_security_group.mongodb_sg.id

  ip_protocol = "tcp"
  from_port   = 27017
  to_port     = 27017

  cidr_ipv6 = "ALLOWED_IPV6_CIDR" # e.g. "2001:db8:1234:5678::/64"
}

Substitute:

aws_vpc.MY_VPC.id with your VPC resource reference.
"ALLOWED_IPV4_CIDR" / "ALLOWED_IPV6_CIDR" with the specific networks that should reach MongoDB.

This change does not replace the security group itself, only its rule resources; it can disrupt traffic to MongoDB if you remove rules without adding appropriate restricted ones.Verification with terraform plan:

You should see the aws_vpc_security_group_ingress_rule resources that used 0.0.0.0/0 and/or ::/0 on port 27017 being destroyed.
You should see any new restricted aws_vpc_security_group_ingress_rule resources being created (if you added them).

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Unrestricted MongoDB Access Should Not Be Allowed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: