MongoDB connection without explicit TLS enforcement and timeouts
Database connections lacked explicit TLS enforcement and timeout configuration, creating potential for plaintext traffic and connection-handling issues in misconfigured environments.
Description
MongoDB connection strings did not explicitly enforce TLS (tls=true) and did not set connection or socket timeouts. In hardened production environments this would still be safe (the deployment enforces TLS at the network layer), but in misconfigured or local environments the connection could fall back to plaintext or hang indefinitely.
Impact
Configuration-level hardening gap. Not directly exploitable in the audited production deployment but a defense-in-depth weakness that should be made explicit in code.
Recommendation
- Set
tls=true(orssl=truefor legacy drivers) explicitly in the connection options. - Add
serverSelectionTimeoutMSandsocketTimeoutMSto fail fast on unresponsive networks. - Document the assumption that the deployment enforces TLS at the network layer, and make the client require it as well.
Ipal Network: Acknowledged. Zealynx: Acknowledged (planned hardening, not in scope for this engagement's fix cycle).