All ports
Referencemedium severity

Port 5984 · CouchDB

CouchDB listens on port 5984 by default. Pre-3.0 builds had a default admin-party mode that allowed full access without credentials.

What runs on port 5984

Apache CouchDB is a document database. Default HTTP API binds to TCP/5984. Older releases shipped in 'admin party' mode — no admin user, no authentication required for any operation. CouchDB 3.0+ enforces admin-account creation at install.

Why public exposure is dangerous

Admin-party CouchDB instances exposed to the internet allow read, write, and database-deletion to any HTTP client. The 2018 mass-ransom wave that hit MongoDB and Elasticsearch also swept CouchDB. Even authenticated CouchDB is vulnerable to weak-password attacks because the HTTP API responds to brute-forcing without rate-limit defaults.

How to lock it down

Bind to `127.0.0.1` or a private network in `local.ini` — `[chttpd] bind_address = 127.0.0.1`. Set strong admin credentials. Use the `[admins]` section in the config or the `_config` API to require authentication on every database. Run TLS in front via a reverse proxy. Host firewall to drop public 5984.

When public exposure is legitimate

Internal-network access from application servers. Public-internet exposure is rarely appropriate — when remote access is needed, terminate TLS and authentication at a reverse proxy that fronts CouchDB.

Other ports DomainCare scans

  • :3306 MySQL MySQL listens on port 3306 by default. Public exposure is a critical data-leak risk.
  • :5432 PostgreSQL PostgreSQL listens on port 5432 by default. Public exposure is a critical data-leak risk equivalent to MySQL.
  • :6379 Redis Redis listens on port 6379 by default. Public exposure historically allows unauthenticated arbitrary code execution.
  • :27017 MongoDB MongoDB listens on port 27017 by default. Historically responsible for the largest single data-leak class — pre-3.0 builds shipped without authentication enabled.