WIXLIB

International Journal of Digital Society (IJDS), Volume 10, Issue 4, December 2019Security Analysis of MongoDBSahib SinghHeinz College, Carnegie Mellon UniversityUSAAbstractNoSQL Databases are a form of non-relationaldatabases whose primary purpose is to store andretrieve data. Due to recent advancements in cloudcomputing platforms and the emergence of Big Data,NoSQL Databases are more becoming popular thanever. In this paper we are going to understand andanalyze the fundamental security features and thevulnerabilities of MongoDB and how it performscompared to relational databases on these fronts.1. IntroductionThe term NoSQL was brought into light by“Carlos Strozzi” who used the term to identify hisdatabase which was a lightweight, open relationaldatabase which didn’t use SQL. The term NoSQLrefers to a system which is Not Only SQL rather thanthe earlier version referring it as a database withoutSQL using to it is SQL like query support system.NoSQL models are generally quicker and are ableto process large amounts of heterogenous datacompared to relational database models hence oftenbeing the first choice while working with large andunstructured datasets owing to their speed andflexibility. Not only can they handle unstructured datathey are also able to process Big Data quickly hencemaking them the first choice among top technologycompanies such as Facebook, Google, Twitter etc.One type of NoSQL database which is going to beour primary focus for this paper will be MongoDB.MongoDB, written in C , is an open source databasewhich is currently the most popular NoSQL databaseaccording to DB-Engines trackingThe DB-Engines ranks over 340 database systemsbased on their popularity. This popularity score isgenerated by taking a number of factors intoconsideration such as search engine results, GoogleTrends, Stack Overflow discussions forums, thenumber of jobs available and profiles present inprofessional networks such as LinkedIn, and socialnetworks like Twitter.2. Features of MongoDB“Binary JSON”. Documents in MongoDB are storedin a collection which are stored in a database.Some features of Mongo DB which are worthgoing over from a security standpoint are given below[5]:1) Map reduce based Aggregation Framework: Thisfeature of MongoDB is similar to the ‘Group By’clause offered in MySQL. MongoDB uses MapReduce paradigm to perform aggregation. A map isbasically a procedure for filtering and sorting datawhile reduce procedure performs a summaryoperation (Eg counting the number of people standingin a queue). MapReduce is generally used toprocessing large volume of data parallely bydistributing it across clusters.2) Schema Less Database: The schema refers to thestructure in which the data should be stored. In thecase of relational databases such schema is definedusing tables. By schema-less we are referring todynamically typed schema as opposed to staticallytyped schemas in Relational Databases. Eg XMLallows you to specify XSD if required however BSONcan accept a varied type of data. Since there is noconstraint on the data and every document in thecollection can have different attributes from eachother we call it schema less.3) Ad-hoc Querying: MongoDB supports SQL likecomplex queries including regex. Similarly, we canalso write queries to fetch data less than or greaterthan a value or use regular expressions for patternmatching.4) Replication and fail-over support: MongoDBsupports replication by distributing data over variousclusters, this is achieved using replica set which isessentially a group of instances hosting the same data.In a replica set, one node is defined as the primarynode while all other nodes classify as secondary. Allwrite operations are assigned to the primary node (i.e.the master node) whereas the secondary nodes mayperform read operations.MongoDB is a document-based databasedeveloped by 10gen which manages collection ofJSON like documents format called BSON or simplyCopyright 2019, Infonomics Society1556

International Journal of Digital Society (IJDS), Volume 10, Issue 4, December 20193. Security FeaturesFollowing are some of the Key Security featuresprovided by MongoDB with regards to authentication,encryption and access control. [4]1) Enabling Access Control: MongoDB requires thatall users (clients as well as servers) provide validcredentials before they are able to connect to ion and requires all users to identifythemselves before a connection is made. With AccessControl enabled, there is a user administrator roledefined which is responsible for creating users,granting and revoking access of other users as well asmodifying user roles.Following is an example on how to set up anadmin provided in the official MongoDBdocumentation:3) System Auditing: The System Auditing facilityallows admins and users to track their systemsactivities during testing and deployment phases.On enabling the Audit System can record thefollowing information: SchemaReplica SetSharded ClustersAuthorizationsCRUD operationsFurther the Auditing system writes every auditdocument to an in-memory buffer of audit eventswhich later get written into disk.4. Security Flaws And AddressalFollowing are some of the Security Issues found inMongoDB and we will always see if there are anyways to address these issues [8]:After the admin has been created, you can then go onto create additional users based on exact accessprinciple (giving the least privilege required).2) Confidential Network: MongoDB only allowsusers to connect over defined interfaces on a givenport in which MongoDB instances are available. Thisis done to reduce the risk of exposure and ensure onlytrusted users have access. This networkconfidentiality can be achieved using the followingtwo routes: IP Binding: Starting MongoDB 3.6, MongoDBbinaries bind to localhost by default. The binary canadditionally bind to other IPv6 addresses by settingthem up through the command line interface orthrough the “net.bindIp” configuration file. Network Hardening: One way to achieve this isusing Firewalls which limits traffic to only those fromtrusted sources. The other way is to use Virtual PrivateNetworks which makes it possible to two networksover an encrypted and limited access network. VirtualPrivate Networks can also be used to preventtampering and “man in the middle” attacks since theytake place over a secure tunnel.Copyright 2019, Infonomics Society1) Lack of Data Encryption Currently there is no encryption on data files inMongoDB. This is a cause of concern since anyonewith access to file systems can extract the informationfrom these files. To prevent any issues arising from such lack ofencryption the application should explicitly encryptall the sensitive information before writing it to theirdatabase also file permissions should be adequatelyput into place to prevent any unauthorized user fromaccessing them.2) Vulnerable to Injection Attacks Simply because MongoDB does not deal directlywith a query language in the form of string does notmake it immune to injection attacks (See examplebelow on how injection attacks take place in SQL).Injection attacks are still possible owing toMongoDB’s dependence on JavaScript. MongoDB’soperations allow arbitrary JavaScript expressions tobe executed directly on the server.Classic SQL InjectionThe above example shows how SQL injectionstake place since 1 1 is always true, the above querywill be executed, and attackers might be able to getaccess to private information (E.g. the above tablemight contain usernames and passwords.) Hence suchstatements might be unknowingly be running on yourdatabase.1557

International Journal of Digital Society (IJDS), Volume 10, Issue 4, December 2019MongoDB InjectionIn the above example, username and passwordhave not been validated to ensure they are stringshence they may contain any field but strings andmanipulate the query structure. Based on MongoDB’s official documentation [4],user can express most queries in MongoDB withoutJavaScript and for the queries which do requireJavaScript, user can mix JavaScript and NonJavaScript inside a single query by placing all theuser-supplied fields directly in a BSON field andpassing JavaScript code to the where field.3) Authentication & Authorization MongoDB does not provide authentication insharded configuration unless run in standalone orreplica set mode also the onus of security lies entirelyin the hand of the developer. Any user by default hasthe permission to access the entire database, moreoverany user with administrator access has completeread/write privileges for the complete database. A reverse proxy can be configured using RESTAPI’s to define fine grained permission adding toauthentication.MongoDB authentication with Kerberos MySQL stores data in the form of tables with rowsand columns. It uses schema to defines it’s databasestructure and requires all rows within the table tofollow the same structure MongoDB stores data in JSON like documents andis schema free i.e. we don’t have to define thestructure first and different documents can havedifferent types of data as earlier discussed.2) Replication MySQL supports master-slave and master-masterreplications and allows multi-source replication. MongoDB has built in features for replication andsharding i.e. distributing data across multiplemachines to support large scale deployments at scale.3) ScalingHorizontal scaling refers to adding more machinesinto our resource pool while Vertical Scaling meansadding more power to an existing machine. Achievinghorizontal scaling with MySQL often requiressignificant engineering efforts and resources andvertical scaling is often not possible beyond a limit.MongoDB can be scaled within and across multipledistributed data centers with high throughput andalmost no downtime [4]. It also provides support forauto sharding and application unaware scaling.6. Mysql Vs Mongodb Security ComparsionFollowing is a comparison done between MySQLand MongoDB from a security standpoint:1) Security Model MySQL provides a privilege-based security modeli.e. providing a user which access to only specificcommands such as CREATE, UPDATE, DELETEetc. hence based on the user type such privileges canbe defined. MongoDB supports TLS and SSL for encryption toensure the data is only accessible to the intended user.5. MongoDB Vs MySQLWhen talking about Relational Databases,MySQL is one of the first database which usuallycomes to mind. It’s a type of relational database whichis currently owned by Oracle and is a part of theLAMP Stack (Linux/Apache/MySQL/php).1) StructureCopyright 2019, Infonomics Society1558