Check for Unrestricted MongoDB Access

More Info:

Ensure that no network security groups allow unrestricted inbound access on TCP ports 27017, 27018 and 27019.

Risk Level

High

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
FedRAMP
GDPR
HITRUST CSF
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
Reserve Bank of India (RBI) Cyber Security Framework
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate unrestricted MongoDB access in Azure:

Log in to the Azure portal (https://portal.azure.com/).
Navigate to the "Azure Cosmos DB" service from the dashboard.
Select the database account that has the unrestricted MongoDB access.
Click on the "Firewalls and virtual networks" option from the left-hand side menu.
Under the "Firewalls and virtual networks" tab, select "Selected networks" and then click on the "Add my IP" button.
This will add your current IP address to the allowed list of IP addresses that can access the database.
If you want to allow access from other IP addresses, you can add them by clicking on the "Add IP range" button.
Once you have added the required IP addresses, click on the "Save" button to save the changes.
After saving the changes, you can verify that the unrestricted MongoDB access has been remediated by attempting to access the database from an IP address that is not on the allowed list. You should receive an error message indicating that access is denied.

That's it! By following these steps, you have successfully remediated the unrestricted MongoDB access in Azure.

Using CLI

To remediate Unrestricted MongoDB Access in Azure using Azure CLI, you can follow the below steps:

Open the Azure CLI on your local machine or use the Azure Cloud Shell.
Run the following command to list all the MongoDB accounts in your Azure subscription:
```
az mongodb list --output table
```
Identify the MongoDB account that has unrestricted access.
Run the following command to update the MongoDB account to restrict access:
```
az mongodb update --resource-group <resource-group-name> --name <mongodb-account-name> --public-network-access Disabled
```
Replace <resource-group-name> with the name of the resource group in which the MongoDB account is located and <mongodb-account-name> with the name of the MongoDB account that you want to update.
After running the above command, the MongoDB account will be updated to restrict access and will only be accessible from within the virtual network or via a private endpoint.

By following the above steps, you can remediate the Unrestricted MongoDB Access misconfiguration in Azure using Azure CLI.

Using Python

To remediate the Unrestricted MongoDB Access misconfiguration in Azure using Python, you can follow the below steps:

Step 1: Install the Azure SDK for Python using pip command:

pip install azure

Step 2: Use the below Python code to remediate the misconfiguration:

from azure.mgmt.network import NetworkManagementClient
from azure.common.credentials import ServicePrincipalCredentials

# Replace the values with your actual subscription ID, client ID, secret key and tenant ID
subscription_id = 'your-subscription-id'
client_id = 'your-client-id'
secret = 'your-secret'
tenant = 'your-tenant-id'

credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=secret,
    tenant=tenant
)

network_client = NetworkManagementClient(credentials, subscription_id)

# Replace the values with your actual resource group and network security group names
resource_group_name = 'your-resource-group-name'
nsg_name = 'your-nsg-name'

# Get the existing NSG rules
nsg = network_client.network_security_groups.get(resource_group_name, nsg_name)

# Remove the existing rule that allows unrestricted MongoDB access
for rule in nsg.security_rules:
    if rule.destination_port_range == '27017' and rule.destination_address_prefix == '*':
        nsg.security_rules.remove(rule)

# Create a new rule that allows MongoDB access only from specific IP addresses
from azure.mgmt.network.v2019_11_01.models import SecurityRule, SecurityRuleProtocol

rule_name = 'mongodb-access'
new_rule = SecurityRule(
    name=rule_name,
    protocol=SecurityRuleProtocol.tcp,
    source_address_prefix='your-ip-address',
    destination_address_prefix='*',
    destination_port_range='27017',
    access='Allow',
    direction='Inbound',
    priority=1000
)

nsg.security_rules.append(new_rule)

# Update the NSG with the new rule
network_client.network_security_groups.create_or_update(resource_group_name, nsg_name, nsg)

In the above code, replace the placeholders your-subscription-id, your-client-id, your-secret, your-tenant-id, your-resource-group-name, your-nsg-name and your-ip-address with your actual values.

This code will remove the existing rule that allows unrestricted MongoDB access and create a new rule that allows access only from specific IP addresses.

Using Terraform

resource "azurerm_network_security_group" "MONGODB_NSG" {
  name                = "MONGODB_NSG"
  location            = azurerm_resource_group.RG.location
  resource_group_name = azurerm_resource_group.RG.name

  # Other existing security rules can stay here (or as separate azurerm_network_security_rule resources)
}

# Replace any existing rules that allow 0.0.0.0/0 on 27017, 27018, 27019
# with restricted-source rules like this. Update SOURCE_CIDR_OR_TAG as needed.
resource "azurerm_network_security_rule" "mongodb_27017_inbound" {
  name                        = "mongodb-27017-restricted"
  priority                    = 200
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "27017"
  source_address_prefix       = "SOURCE_CIDR_OR_TAG" # e.g. "10.0.0.0/16" or "AzureLoadBalancer"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.MONGODB_NSG.name
}

resource "azurerm_network_security_rule" "mongodb_27018_inbound" {
  name                        = "mongodb-27018-restricted"
  priority                    = 201
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "27018"
  source_address_prefix       = "SOURCE_CIDR_OR_TAG" # e.g. "10.0.0.0/16"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.MONGODB_NSG.name
}

resource "azurerm_network_security_rule" "mongodb_27019_inbound" {
  name                        = "mongodb-27019-restricted"
  priority                    = 202
  direction                   = "Inbound"
  access                      = "Allow"
  protocol                    = "Tcp"
  source_port_range           = "*"
  destination_port_range      = "27019"
  source_address_prefix       = "SOURCE_CIDR_OR_TAG" # e.g. "10.0.0.0/16"
  destination_address_prefix  = "*"
  resource_group_name         = azurerm_resource_group.RG.name
  network_security_group_name = azurerm_network_security_group.MONGODB_NSG.name
}

Substitute:

azurerm_resource_group.RG with your actual resource group reference.
MONGODB_NSG with the NSG that currently allows unrestricted MongoDB access.
SOURCE_CIDR_OR_TAG with the specific CIDR blocks or service tags that are allowed to reach MongoDB, never "0.0.0.0/0".

This change updates rules in place (no NSG replacement), but it may block existing public MongoDB access if clients are not in the allowed CIDRs.

To verify, terraform plan should show:

Removal or modification of any existing azurerm_network_security_rule that had source_address_prefix = "0.0.0.0/0" and destination_port_range (or ranges) including 27017, 27018, or 27019.
Creation or update of the three restricted rules above with non-public source_address_prefix values.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​