T06 · System Persistence
Warning
- Location
- INSTALL-UBUNTU.md:40
- Finding
- MongoDB Is Registered as a Persistent Boot-Time Service<![CDATA[ ## Vulnerability Details **File Location**: `INSTALL-UBUNTU.md`, lines 40–43 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium **Vulnerable Code:** ```bash ## 3. Start and enable the service sudo systemctl start mongod sudo systemctl enable mongod ``` ### Technical Analysis The installation guide instructs users to run `systemctl enable mongod` with root privileges. This creates a persistent system-service registration that causes MongoDB to start automatically on subsequent boots. Running a MongoDB server is necessary when the Skill uses a local database, but automatic boot-time startup is not necessary for its declared CRUD functionality. The instruction therefore exceeds the minimum privilege and persistence requirements for temporary or occasional Skill use. It also leaves a network-facing database process running outside the lifetime of the Skill. This is an explicit and documented service installation rather than a concealed backdoor. Nevertheless, it increases the system's persistent attack surface, particularly if MongoDB is subsequently configured with an unsafe bind address, insufficient authentication, or excessive database privileges. ### Attack Path 1. A user follows the Ubuntu installation instructions with administrative privileges. 2. `sudo systemctl enable mongod` creates the boot-time service registration. 3. MongoDB starts automatically after future system boots, regardless of whether the Skill is in use. 4. If MongoDB has weak authentication or network binding settings, a local or network attacker reaches the continuously available service. 5. The attacker uses the exposed database privileges to read, alter, or delete accessible MongoDB data. ### Impact Assessment The command makes a root-authorized, cross-session system configuration change. It does not itself grant an attacker root access or install attacker-controlled code, but it maintains a continuously running service and expands the duration d ...[truncated 326 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Make service enablement optional rather than part of the default installation procedure. - Use `sudo systemctl start mongod` as the minimum default required for local operation. - Document `sudo systemctl enable mongod` only for users who explicitly require MongoDB after every reboot. - Provide rollback instructions: ```bash sudo systemctl disable --now mongod ``` - Before recommending persistent operation, require users to verify MongoDB's bind address, authentication configuration, firewall policy, and database-user privileges. - Recommend binding exclusively to loopback for local-only use and using a dedicated, least-privilege MongoDB account. ]]>