8

I'm developing a RESTful API using MongoDB as the backend. The easiest thing to do programmatically would be to simply use MongoDB's _id field in the URI, such as:

https://api.example.com/collection/507c7f79bcf86cd7994f6c0e

I know that the ObjectID is based in part on the creation timestamp. Is there anything else an attacker could gain from knowledge of the ObjectID?

Ben
  • 323
  • 2
  • 8

2 Answers2

9

According to Mongo's documentation, the following is used to construct an ObjectId: 

ObjectId is a 12-byte BSON type, constructed using:

  a 4-byte value representing the seconds since the Unix epoch,
  a 3-byte machine identifier,
  a 2-byte process id, and
  a 3-byte counter, starting with a random value.

So to answer your question,

Is there anything else an attacker could gain from knowledge of the ObjectID?

I would say that it seems like in addition to the time stamp they could also determine the machine identifier, the process id and your counter value.

Make sure that you are protecting yourself against direct object reference attacks (which you should be doing anyway).

Abe Miessler
  • 8,155
  • 10
  • 44
  • 72
  • Could any of this information be used for an attack? – Ben Jul 23 '14 at 00:08
  • I suppose if you had a shell injection vulnerability they could kill your mongo process or something. But they would probably be able to do that without knowing the exact process ID also. – Abe Miessler Jul 23 '14 at 00:13
  • It seems like they removed the machine identifier bit in one of their later releases. – tyteen4a03 Nov 20 '18 at 15:28
2

MongoDB OID's are predictable. So if you have access restrictions you need to inforce, such as not allowing person A from Group 1 access to similarly classed objects belonging to persons in Group 2, then you will need to make sure you're application enforces these rules for all points of access.

A disastrous strategy, for example, would be to store an OID for a user in the browser, possibly acquired and stored after authZ, and use it for authN, since all that would be needed to change you're identity in the server would be to twiddle the browser-stored OID to match someone else's.

Rondo
  • 217
  • 1
  • 4