---
name: rt-exploit-mongodb
description: "MongoDB security assessment skill for authorized exposure validation, access control review, NoSQL injection testing, TLS, backup posture, audit logging, and remediation."
---

# rt-exploit-mongodb - MongoDB Assessment

## Overview

MongoDB risk usually appears as public exposure, weak authentication, permissive roles, missing TLS, unvalidated query objects, or sensitive data in collections. This skill emphasizes safe NoSQL injection testing and configuration review.

## Prerequisites

- In-scope cluster/database/application endpoint.
- Test users and role expectations.
- Approved test records or collection.
- Data sampling limits.

## Assessment Areas

| Area | Checks |
|---|---|
| Exposure | Public listener, Atlas network access, firewall rules. |
| Authentication | Auth enabled, SCRAM/OIDC/IAM integration, shared users. |
| Authorization | Role scope, database separation, admin privileges. |
| Transport | TLS enforcement. |
| NoSQL Injection | Operator injection through JSON/filter inputs. |
| Backups | Snapshot access, public exports, retention. |
| Logging | Audit events and suspicious query visibility. |

## Workflow

1. Confirm cluster and role scope.
2. Inventory exposure, auth, TLS, and roles.
3. Map application query inputs that accept objects or filters.
4. Validate NoSQLi only against approved test records.
5. Review sensitive collection access by role.
6. Recommend schema validation and role reduction.

## Evidence

Capture role summaries, redacted connection settings, paired app requests, and test-record behavior. Do not export production collections.

## Remediation

- Restrict network access.
- Enforce authentication and TLS.
- Reduce roles.
- Validate schemas and allowlist operators.
- Avoid passing raw user JSON into queries.
- Monitor suspicious reads and auth failures.


## Finding Examples

| Finding | Severity Driver |
|---|---|
| Public MongoDB listener | Internet data exposure risk. |
| Weak role separation | Excess collection access. |
| Raw filter injection | Authorization bypass or data exposure. |
| Missing TLS | Credential and data interception. |

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-mongodb --phase exploitation --cmd "MongoDB posture review" --output "redacted database risk summary"
```
