MongoDB unauthorized users can create databases

Question

We have an old MongoDb 2.2.6 deployment and lately we were requested to introduce anonymous user blocking to the Db. I followed the MongoDb tutorials and created an authentication user first and started the mongod with

--auth

parameter.

Then after login, I could not execute any db related commands except for the

use << db >>

. Everything was perfect. But then I tried issuing

use <<< some_junk_db_name >>

without authentication and then issued

db.some_collection.find()

command. Mongodb correctly raised an exception but later when I checked, that DB was there.

Is this a bug with MongoDb 2.2.6 or am I missing something here ?

Simulant · Accepted Answer · 2017-08-28 17:23:34Z

2

This is a reported Bug with the number 2080 and the ticket is still not fixed. The last comment, May 17 2013, from a MongoDB Inc. member says that the Bug is still existing in the 2.4 version of MongoDB.

In Version 3.4 the Bug was no longer reproducable.

edited Aug 28, 2017 at 17:23

answered Jun 30, 2014 at 7:48

Simulant

20.2k10 gold badges68 silver badges106 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Stennie Over a year ago

Note that this creates a phantom (empty) database rather than allocating storage for the DB (but is still a bug). The database name should not persist after a restart of mongod.

Collectives™ on Stack Overflow

MongoDB unauthorized users can create databases

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related