CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// Databases & caches

Port 5984: CouchDB

Apache CouchDB HTTP API.

5984

How CouchDB works

Databases & caches
app:5984GET /db/42{ "id": 42 } app:5984GET /db/42{ "id": 42 }

The application asks for documents stored as JSON and gets them back over port 5984. It travels in clear text: anyone on the path can read it.

Transport
TCP · UDP
Exposure risk
8/10 high if reachable from the Internet
Encryption
Clear textreadable on the network
IANA status
Assigned1 registered service
Range
Registered (1024-49151)
Category
Databases & caches
01 Security

Is port 5984 dangerous?

Common attacks and weaknesses

  • Admin party mode (no admin) on old versions, RCE vulnerabilities (CVE-2017-12636).

How to secure it

  • Set an admin account, bind privately, put TLS in front.
02 Registry

IANA registry entries for port 5984

ServicePortTransportDescriptionReferenceUpdated
couchdb 5984 TCP, UDP CouchDB - 2007-11-27

// source: IANA service name and port number registry

03 Check it

Which program uses port 5984, and is it reachable?

Linux

sudo ss -ltnup 'sport = :5984'      # process listening on 5984
sudo lsof -nP -i :5984

macOS

sudo lsof -nP -i :5984

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5984 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 5984
netstat -ano | findstr :5984

From another machine

nmap -p 5984 -sV <host>
sudo nmap -sU -p 5984 <host>
nc -zv <host> 5984

Block it in the firewall

sudo ufw deny 5984/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 5984" -Direction Inbound -LocalPort 5984 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 5984 used for?

Apache CouchDB HTTP API.

Is port 5984 TCP or UDP?

Port 5984 is registered for TCP and UDP. In practice the service mostly uses TCP.

Is it safe to open port 5984?

It is rated 8/10 (high) when exposed to the Internet. Admin party mode (no admin) on old versions, RCE vulnerabilities (CVE-2017-12636). Set an admin account, bind privately, put TLS in front.

How do I check if port 5984 is open?

On Linux run "ss -ltnup 'sport = :5984'", on macOS "lsof -nP -i :5984", and on Windows "netstat -ano | findstr :5984" to see the local process. From another machine, "nmap -p 5984 <host>" shows whether it is reachable.

05 Related
:3306 MySQL / MariaDB tcp · udp · high risk :1433 Microsoft SQL Server tcp · udp · high risk :5432 PostgreSQL tcp · udp · high risk :6379 Redis tcp · critical risk :27017 MongoDB tcp · critical risk :9200 Elasticsearch tcp · udp · critical risk :1521 Oracle Database tcp · udp · high risk :11211 Memcached tcp · udp · high risk

Latest vulnerability news

All news