# MA-643.012017: MyCERT Advisory - MongoDB and Elasticsearch Default Installation without Authentication

**Date:** 17 Jan 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-643.012017  
**Advisory ID:** MA-643.012017

---

**1.0 Introduction**
MyCERT received information regarding unavailability of security authentication in default MongoDB and Elasticsearch installation, thus making it potential to vulnerability and threats. MongoDB is a popular NoSQL database being used in big data and heavy analytics environments. Elasticsearch is a search engine based on Lucene.
**2.0 Impact**
The impact of not having proper security authentication, a remote attacker can access to the database system including create, read, update, and delete documents, collections, and databases. The attacker has also possible access to sensitive or confidential information of the database.
**3.0 Affected Products**
• All MongoDB and Elasticsearch versions with default installation and weak password.
**4.0 Recommendations**
• MyCERT highly recommends users of this application to enable security authentication, implement strong password and restrict access to the MongoDB and Elasticsearch service.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practices and security policies to determine the necessary updates that should be in place.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#65061c0700175c5c5c25061c07001716000610170c111c4b081c) or [[email protected]](/cdn-cgi/l/email-protection#ddb0a4beb8afa99db0a4beb8afa9f3b2afbaf3b0a4) â€¨
Phone: 1-300-88-2999 (monitored during business hours)
â€¨Fax: +603 89453442 â€¨
Mobile: +60 19 2665850 (24x7 call incident reporting)â€¨
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
â€¨Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYTâ€¨
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• <https://www.tenable.com/plugins/index.php?view=single&id=81777>
• <https://docs.mongodb.com/manual/tutorial/enable-authentication/>
• <https://docs.mongodb.com/manual/reference/configuration-options/>
• [http://en.wikipedia.org/wiki/Elasticsearch](http://en.wikipedia.org/wiki/Elasticsearch  )