{
  "port": 27017,
  "protocol": "tcp",
  "service": "MongoDB",
  "oneLiner": "MongoDB's default port, registered to MongoDB, Inc. since 2019.",
  "whatItIs": "27017 is the default listening port for `mongod` and `mongos`; sharded and config servers use 27018 and 27019. Access control is not enabled by default, so a server started without --auth and bound beyond localhost hands full read/write to anyone who connects. Point a browser at it and MongoDB answers over HTTP with a note that you are hitting the native driver port, which makes it easy to fingerprint.",
  "exposure": {
    "verdict": "never",
    "note": "MongoDB's security checklist calls for enabling access control and restricting net.bindIp to trusted clients — an exposed 27017 is the classic ransomed-database scan hit."
  },
  "checkCommand": "curl -s http://127.0.0.1:27017/",
  "links": [
    {
      "title": "MongoDB — Default MongoDB Ports",
      "url": "https://www.mongodb.com/docs/manual/reference/default-mongodb-port/",
      "kind": "official-docs"
    },
    {
      "title": "MongoDB — Security Checklist",
      "url": "https://www.mongodb.com/docs/manual/administration/security-checklist/",
      "kind": "official-docs"
    },
    {
      "title": "mongodb/mongo on GitHub",
      "url": "https://github.com/mongodb/mongo",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 27017 (mongodb)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=27017",
      "kind": "iana"
    }
  ]
}