HighExposed servicesBLWK-NET-003

A database or development service is open to the network

What this means

A database or development service is reachable from your network on port ‹port› (listening on ‹listen address›). On home, office or café Wi-Fi, anyone nearby can connect to it, and development services often run without a password. Docker opens ports to the whole network by default.

How to fix it

Make the service reachable from this computer only.

1. For Docker Compose, change the port line from ‹port›:‹port› to 127.0.0.1:‹port›:‹port› and restart the stack.
2. For a service installed directly, set its listen or bind address to 127.0.0.1 in its config file.
3. Need it from another machine? Use an SSH tunnel (ssh -L ‹port›:localhost:‹port› you@this-machine) or a private network such as Tailscale or WireGuard.

Check it yourself

Run a scan and look for BLWK-NET-003 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads listening_ports and reports this check when:

listen_address in ["0.0.0.0", "::"] and port in [1025, 2375, 3306, 5432, 5672, 6379, 8025, 9000, 9001, 9200, 10050, 10051, 11211, 15672, 27017]

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1133
• MITRE ATT&CK T1210

Related checks

• A VNC/remote-desktop port is listening · BLWK-NET-001
• A port commonly used by ngrok's local API is listening · BLWK-NET-002
• No host firewall is filtering incoming connections · BLWK-NET-004