Accessible/Open MongoDB NoSQL Server Scanning Project
If you are looking at this page, then more than likely, you noticed a scan coming from this server across your network and/or poking at your MongoDB Server service.
The Shadowserver Foundation is currently undertaking a project to search for publicly accessible devices that have a MongoDB NoSQL Server running. The goal of this project is to identify openly accessible systems that have MongoDB running and report them back to the network owners for remediation.
Authentication is available for MongoDB, however, we have found that in the majority of installations authentication is not enabled. Without authentication, the MongoDB instance can be completely accessed by anyone.
All MongoDB servers that we find to be accessible have been incorporated into our reports and are being reported on a daily basis.
Methodology
We are querying all computers with routable IPv4 addresses that are not firewalled from the internet on port 27017/tcp with the command "buildInfo" and capturing the response. A secondary test is then performed with the command "listDatabases". We intend no harm, but if we are causing problems, please contact us at gro [tod] revreswodahs [ta] nacssnd
Blocklisting
To be removed from this set of scanning you will need to send an email to dnsscan [at] shadowserver [dot] org with the specific CIDR's that you would like to have removed. You will have to be the verifiable owner of these CIDR's and be able to prove that fact.
Useful Links
- Blog Summary: https://www.shadowserver.org/news/the-scannings-will-continue-until-the-internet-improves/
- Get reports on your network: https://www.shadowserver.org/what-we-do/network-reporting/get-reports/
- Statistics: https://scan.shadowserver.org/mongodb/stats/
Scan Status
Statistics on current run
Other Statistics
If you would like other statistics and information on historical trends, please take a look at: https://scan.shadowserver.org/mongodb/stats/. Otherwise, stats from the most current scan are listed below.
Stats from the most current scan are listed below.
All devices with MongoDB Accessible
(Click image to enlarge)
If you would like to see more regions click here
All devices with MongoDB Accessible
(Click image to enlarge)
MongoDB Servers Without Authentication
(Click image to enlarge)
If you would like to see more regions click here
MongoDB Servers Without Authentication
(Click image to enlarge)
If you would like us to not scan your network, please let us know and we will remove your networks from the scan.
Likewise, if you have anymore questions please feel free to send us an email at: gro [tod] revreswodahs [ta] nacssnd