Exposed Datastores: Redis, Mongo, Elastic, Firebase

A reachable datastore is rarely just data. Sessions, queue payloads and operational secrets tend to live in the same service as the cache.

Vector Databases

A vector database may look like technical storage while holding embeddings from documents that should never mix across users. Vector stores index embeddings with metadata. Tenant and source filtering usually happens alongside similarity search. Weak metadata filters, unauthenticated admin endpoints and backup exposure may leak corpus data or allow poisoning. I test API authentication, namespace isolation, metadata filters, delete behavior and who may insert documents. An embedding is not encryption of the source content. Many platforms store original text or recoverable metadata alongside vectors.

In a lab index, run the same similarity query twice, once with the tenant metadata filter and once without, and compare what comes back.

Redis

Redis often stores cache entries, sessions, jobs and operational secrets in the same service. An exposed instance may reveal far more than temporary keys. Redis supports modern ACLs, AUTH, TLS and administrative commands. Older or internal instances still appear with insufficient protection. Data may include session tokens, queue payloads, rate-limit state and application secrets. Modules and configuration expand the surface in specific versions and scenarios. I confirm network reachability, TLS, authentication and ACLs using read-only commands before enumerating keyspace. Finding port 6379 open does not prove anonymous exposure. Protected mode, bind settings, firewalls and ACLs need validation in context.

redis-cli -h 10.10.10.20 PING
redis-cli -h 10.10.10.20 ACL WHOAMI
redis-cli -h 10.10.10.20 INFO server

Elasticsearch and OpenSearch

Search clusters often receive logs, documents and operational data from many systems. Broad access there can become cross-organization visibility. Elasticsearch and OpenSearch expose REST APIs for indices, search, ingest, snapshots and administration. Security plugins define authentication and roles. Snapshots, scripts, ingest pipelines and remote clusters create paths beyond simply reading documents. I start with version, cluster health and current identity, then test permissions on a lab index. Read-only access to logs may expose Authorization headers and secrets that become other identities. Impact needs to follow the discovered data.

curl -s https://search.example.test/
curl -s https://search.example.test/_cluster/health

Exposed MongoDB

Internal MongoDB often carries data nobody expected outside the application. Network exposure turns that into an identity problem. MongoDB controls bindIp, TLS, authentication and roles. Older environments became known for deployments without authentication. Databases may store password hashes, OAuth tokens, configuration and queues. Write access may alter application state. I confirm authentication requirements and current roles before listing databases. Write tests use a disposable collection. An open port on an internal network may be intentional. The finding comes from a principal reaching more data or actions than intended.

mongosh 'mongodb://10.10.10.20:27017/' --eval 'db.runCommand({connectionStatus:1})'

Firebase

Firebase makes backend integration easy. When Security Rules are permissive, the same SDK that helps developers also helps any modified client. Firestore, Realtime Database and Cloud Storage apply service-specific security rules. Firebase Authentication provides identity, while rules decide object access. Public Firebase configuration identifies projects and endpoints. Client API keys are generally not secrets by themselves. I test rules with two accounts, crossed documents and read or write operations against lab resources. allow read, write: if true is obvious. More interesting bugs appear in ownership, custom claims and nested paths.

curl -s 'https://firestore.googleapis.com/v1/projects/<project>/databases/(default)/documents/users'

References

• Redis security
• Elasticsearch: secure a cluster
• OpenSearch security
• Security Checklist
• Security Rules
• Security checklist