Detections
Analytics

6.3 Ensure that server-side scripting is disabled if not needed

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

MongoDB supports the execution of JavaScript code for certain server-side operations: mapReduce, group, $where, $accumulator, and $function aggregation operations that allow users to define custom aggregation expressions. If you do not use these operations, server-side scripting should be disabled.

If server-side scripting is not needed and is not disabled, this introduces unnecessary risk which may allow an attacker to take advantage of insecure coding.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

If server-side scripting is not required, for mongod instance disable it by using the --noscripting option on the command line, or setting security.javascriptEnabled to false in the configuration file.

Starting in MongoDB 4.4 this is also applicable to mongos.

Impact:

Disabling server-side scripting will block all server-side scripts from executing.

See Also

https://workbench.cisecurity.org/benchmarks/19909

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-7, 800-53|CM-7(1), 800-53|SI-7, 800-53|SI-7(1), CSCv7|2.9, CSCv7|4.7, CSCv7|7.3

Plugin: Unix

Control ID: 3ae1dcc484f2b08fdf1103f74d1e0587bd4483c9d29b9473a1caaf84950c9ef5