6.3 Ensure that server-side scripting is disabled if not needed

Information

MongoDB supports the execution of JavaScript code for certain server-side operations: mapReduce, group, $where, $accumulator, and $function aggregation operations that allow users to define custom aggregation expressions. If you do not use these operations, server-side scripting should be disabled.

Rationale:

If server-side scripting is not needed and is not disabled, this introduces unnecessary risk which may allow an attacker to take advantage of insecure coding.

Impact:

Disabling server-side scripting will block all server-side scripts from executing.

Solution

If server-side scripting is not required, for mongod instance disable it by using the --noscripting option on the command line, or setting security.javascriptEnabled to false in the configuration file.
Starting in MongoDB 4.4 this is also applicable to mongos.

Default Value:

Enabled

See Also

https://workbench.cisecurity.org/benchmarks/15135

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|9.2

Plugin: Windows

Control ID: 3ae1dcc484f2b08fdf1103f74d1e0587bd4483c9d29b9473a1caaf84950c9ef5