A legal analytics company exposed passwordless database with sensitive documents

guest · Mar 15, 2019

A legal analytics company exposed passwordless database with sensitive documents
March 15, 2019
https://securitydiscovery.com/a-leg...sswordless-database-with-sensitive-documents/

On March 2nd, 2019, I have discovered an open and unprotected Elasticsearch cluster which contained 257,287 legal documents labeled as ‘not designated for publication‘. The research was part of our initiative to identify and alert organizations that are misconfiguring noSql databases, such as MongoDB, CouchDB, Elasticsearch etc.

A 4.7GB instance hosted on a US-based Amazon AWS server was indexed by popular IoT search engines, such as Shodan.
After initial investigation we assumed that data is managed by Lex Machina, an IP litigation research company and division of LexisNexis that develops legal analytics data and software, and sent them a security notification alert. [...] I tend to assume that database in question was handled by a company named LexSphere (based in India)

Danger of having exposed Elasticsearch or similar NoSql databases is huge. I have previously reported that the lack of authentication allowed the installation of malware or ransomware on the MongoDB servers.
Click to expand...

Log in or Sign up

A legal analytics company exposed passwordless database with sensitive documents

guest Guest

Log in or Sign up

A legal analytics company exposed passwordless database with sensitive documents

guest Guest

Useful Searches