CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Databases & caches

Port 27017: MongoDB

MongoDB database server.

27017

How MongoDB works

Databases & caches
app:27017find(){ "id": 42 } app:27017find(){ "id": 42 }

The application asks for documents stored as JSON and gets them back over port 27017. Encryption is optional: traffic is only protected if TLS is enabled on the server and the client.

Transport
TCP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
Optional TLSTLS only if negotiated
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
Databases & caches
01 Security

Is port 27017 dangerous?

Common attacks and weaknesses

  • Instances without authentication exposing every collection.
  • Mass wiping and ransom campaigns on open databases.
  • Data leaks indexed by Internet scanners.

How to secure it

  • Enable authorization and bind to private addresses.
  • Require TLS.
  • Never publish the Docker port of a database on 0.0.0.0.
02 Registry

IANA registry entries for port 27017

ServicePortTransportDescriptionReferenceUpdated
mongodb 27017 TCP Mongo database system - 2019-02-21
-27017-Reserved--

// source: IANA service name and port number registry

03 Check it

Which program uses port 27017, and is it reachable?

Linux

sudo ss -ltnup 'sport = :27017'      # process listening on 27017
sudo lsof -nP -i :27017

macOS

sudo lsof -nP -i :27017

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 27017 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 27017
netstat -ano | findstr :27017

From another machine

nmap -p 27017 -sV <host>
nc -zv <host> 27017

Block it in the firewall

sudo ufw deny 27017/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 27017" -Direction Inbound -LocalPort 27017 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 27017 used for?

MongoDB database server.

Is port 27017 TCP or UDP?

Port 27017 is registered for TCP.

Is it safe to open port 27017?

It is rated 9/10 (critical) when exposed to the Internet. Instances without authentication exposing every collection. Enable authorization and bind to private addresses.

How do I check if port 27017 is open?

On Linux run "ss -ltnup 'sport = :27017'", on macOS "lsof -nP -i :27017", and on Windows "netstat -ano | findstr :27017" to see the local process. From another machine, "nmap -p 27017 <host>" shows whether it is reachable.

05 Related
:3306 MySQL / MariaDB tcp · udp · high risk :1433 Microsoft SQL Server tcp · udp · high risk :5432 PostgreSQL tcp · udp · high risk :6379 Redis tcp · critical risk :9200 Elasticsearch tcp · udp · critical risk :1521 Oracle Database tcp · udp · high risk :11211 Memcached tcp · udp · high risk :5984 CouchDB tcp · udp · high risk

Latest vulnerability news

All news