id: file-mongodb-auth-disabled

info:
  name: MongoDB Authentication Disabled
  author: pussycat0x
  severity: high
  description: |
    Detects if MongoDB authentication is disabled or missing in mongod.conf. If 'authorization: enabled' is missing under 'security:', authentication is not enforced.
  reference:
    - https://wiki.devsecopsguides.com/docs/checklists/mongodb/
    - https://wiki.devsecopsguides.com/docs/checklists/mongodb/
  metadata:
    verified: true
  tags: file,mongodb,audit,hardening

file:
  - extensions:
      - conf

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "storage"
          - "operationProfiling"
          - "#security"
        condition: and

      - type: word
        words:
          - "authorization: enabled"
        negative: true
# digest: 490a0046304402203908544123052db08fd523dc16090b44c17b03c8012ca0ca49145c22548e49a30220673d23799471c1c3380e7d46b6b38f3abfdbaae0f0f33713e7ecf882c1601ba7:922c64590222798bb761d5b6d8e72950