{"record":{"id":"333b97defd59230f","repo":"shadow1ng/fscan","slug":"i18n-gettext-service-no-credentials","errorCode":null,"errorMessage":"i18n.GetText(\"service_no_credentials\")","messagePattern":"i18n\\.GetText\\(\"service_no_credentials\"\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/mongodb.go","lineNumber":68,"sourceCode":"\t\treturn &ScanResult{Success: false, Service: \"mongodb\", Error: err}\n\t}\n\n\tif isUnauth {\n\t\tsession.LogVuln(i18n.Tr(\"mongodb_unauth\", target))\n\t\treturn &ScanResult{\n\t\t\tType:    plugins.ResultTypeVuln,\n\t\t\tSuccess: true,\n\t\t\tService: \"mongodb\",\n\t\t\tVulInfo: i18n.GetText(\"unauthorized_access\"),\n\t\t}\n\t}\n\n\tcredentials := GenerateCredentials(\"mongodb\", config)\n\tif len(credentials) == 0 {\n\t\treturn &ScanResult{\n\t\t\tSuccess: false,\n\t\t\tService: \"mongodb\",\n\t\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"service_no_credentials\")),\n\t\t}\n\t}\n\n\tauthFn := p.createAuthFunc(info, config, state)\n\ttestConfig := DefaultConcurrentTestConfigWithTarget(config, info)\n\n\tresult := TestCredentialsConcurrently(ctx, credentials, authFn, \"mongodb\", testConfig)\n\n\tif result.Success {\n\t\tsession.LogVuln(i18n.Tr(\"mongodb_credential\", target, result.Username, result.Password))\n\t}\n\n\treturn result\n}\n\nfunc (p *MongoDBPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {\n\treturn func(ctx context.Context, cred Credential) *AuthResult {\n\t\treturn p.doMongoDBAuth(ctx, info, cred, config, state)","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/mongodb.go#L50-L86","documentation":"The MongoDB plugin's Scan returns this error when GenerateCredentials(\"mongodb\", config) produces an empty credential list, so there is nothing to brute-force. This typically means the credential dictionary for mongodb is empty in the loaded config or all default and user-supplied credentials were filtered out. The scan aborts early instead of testing zero credentials.","triggerScenarios":"Running the mongodb plugin with brute enabled when: the built-in mongodb credential dictionary is empty or was replaced by an empty list; user-supplied username/password lists are both empty or whitespace-only; a config filter removes every candidate credential.","commonSituations":"Users passing empty -user/-pass style flags expecting defaults to be kept; a custom config file overriding the mongodb credential section with an empty array; tooling that programmatically builds a Config and forgets to populate credentials.","solutions":["Supply credentials explicitly via the scan CLI flags (e.g. username/password lists).","Remove or fix the custom config entry that empties the mongodb credential dictionary.","Fall back to the built-in default mongodb credential list instead of a custom empty one.","If embedding fscan, populate Config with at least one Credential for mongodb before calling Scan.","Verify GenerateCredentials(\"mongodb\", config) output in a debug run to see why it is empty."],"exampleFix":"// before\ncfg := common.Config{ /* no users/pass set */ }\nresult := plugin.Scan(ctx, info, session) // -> service_no_credentials\n// after\ncfg.Users = []string{\"root\", \"admin\", \"mongoadmin\"}\ncfg.Passwords = []string{\"\", \"root\", \"123456\", \"mongoadmin\"}\nif len(GenerateCredentials(\"mongodb\", &cfg)) == 0 {\n    log.Println(\"skipping mongodb brute: no credentials configured\")\n    return\n}\nresult := plugin.Scan(ctx, info, session)","handlingStrategy":"validation","validationCode":"creds := services.GenerateCredentials(\"mongodb\", config)\nif len(creds) == 0 {\n\treturn fmt.Errorf(\"no mongodb credentials configured; set user/password lists before scanning\")\n}\n// safe to proceed with plugin.Scan","typeGuard":null,"tryCatchPattern":"result := plugin.Scan(ctx, info, session)\nif !result.Success && result.Error != nil && strings.Contains(result.Error.Error(), \"credential\") {\n\tlog.Println(\"mongodb scan aborted: no credentials available; check config user/password lists\")\n}","preventionTips":["Always populate username/password lists (or keep defaults) before brute-mode scans","Validate that config overrides don't empty the mongodb credential dictionary","Unit-test GenerateCredentials(\"mongodb\", cfg) returns non-empty for your config","Log credential counts at scan start so an empty list is obvious immediately"],"tags":["mongodb","credentials","brute-force","config"],"backgroundTag":"missing-credentials","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}