6.3 Ensure that server-side scripting is disabled if not needed

Information

MongoDB supports the execution of JavaScript code for certain server-side operations: mapReduce, group, $where, $accumulator, and $function aggregation operations that allow users to define custom aggregation expressions. If you do not use these operations, server-side scripting should be disabled.

Rationale:

If server-side scripting is not needed and is not disabled, this introduces unnecessary risk which may allow an attacker to take advantage of insecure coding.

Impact:

Disabling server-side scripting will block all server-side scripts from executing.

Solution

If server-side scripting is not required, for mongod instance disable it by using the --noscripting option on the command line, or setting security.javascriptEnabled to false in the configuration file.
Starting in MongoDB 4.4 this is also applicable to mongos.

Default Value:

Enabled

See Also

https://workbench.cisecurity.org/benchmarks/15136

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|9.2

Plugin: Windows

Control ID: fca830d6273febc7471c1f3485fbe101819ed639daa5129fe74d9757146e4843