Details

MongoDB by default provides an HTTP interface running on port 28017 to provide the home status page. This page provides certain critical information about the databases statistics and clients.

Please note that this function has been Deprecated since version 3.2.

Rationale:

An attacker could access the status page to learn more about the MongoDB server and determine how to compromise it.

Solution

Disable the HTTP status interface by setting nohttpinterface = True in the /etc/mongod.conf file.

Default Value:

Enabled

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/168

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-7b.

Source

• Tenable.com/audits