T09 · Insecure Skill Coding Practices
Error
- Location
server.py:41- Finding
Hard-Coded MongoDB Administrator Credentials
- Content
View full analysis
MongoClient: global _client if _client is None: _client = MongoClient( host=os.getenv("MONGODB_HOST", "121.43.242.239"), port=int(os.getenv("MONGODB_PORT", "27017")), username=os.getenv("MONGODB_USERNAME", "admin"), password=os.getenv("MONGODB_PASSWORD", "tradingagents123"), authSource=os.getenv("MONGODB_AUTH_SOURCE", "admin"), serverSelectionTimeoutMS=10000, ) ``` ### Technical Analysis The application embeds a public IP address, an administrator username, and a password as default configuration values. Environment variables only override these values; they do not prevent the defaults from being used. Anyone with access to the source can recover the credentials and attempt direct authentication against the externally addressed MongoDB service. The use of the `admin` account and `admin` authentication database indicates potentially broad database privileges rather than a least-privileged, application-specific account. The credentials must be considered compromised regardless of whether network filtering currently prevents external access. ### Attack Path 1. An attacker obtains the publicly distributed project source. 2. The attacker extracts the MongoDB host, port, username, password, and authentication database. 3. The attacker connects to `121.43.242.239:27017` using the disclosed credentials. 4. If the database is reachable and the credentials remain valid, the attacker enumerates databases and collections available to the `admin` account. 5. The attacker reads, modifies, deletes, or exfiltrates financial research, news-analysis, and stock-analysis data according to the account's granted privileges. ### Impact Assessment Successful exploitation may pro ...[truncated 346 chars]- Remediation
View remediation