Dungsocool/CVE-2017-12635_36

GitHubRepository PoCWriteup

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup documenting the step-by-step exploitation of CVE-2017-12635 (privilege escalation) and CVE-2017-12636 (remote code execution) against Apache CouchDB 1.6.0. It describes the attack surface, authentication bypass via duplicate JSON keys, and subsequent RCE through query server configuration injection, including curl commands and verification steps.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single README.md file that documents a lab exercise demonstrating the CVE-2017-12635 and CVE-2017-12636 exploit chain against Apache CouchDB. The file contains only explanatory text, curl commands, and screenshots describing the legitimate exploitation process. No backdoor, deceptive payload, or concealed harmful behavior targeting the reader was observed.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
Languagesmarkdown
Target softwareApache CouchDB
Attack typesprivilege escalationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a detailed technical analysis and walkthrough of exploiting CVE-2017-12635 and CVE-2017-12636. It contains no executable code, only documentation and curl command examples. The analysis_routing classification is NO_POC_CODE_IDENTIFIED, and the content is a writeup describing the exploitation process.

README.md:1-189

Requirements

  • Target running Apache CouchDB 1.6.0 with HTTP API exposed on port 5984README.md:27-29

Observed behavior

  • Sends a PUT request to /_users with duplicate 'roles' keys to create an admin userREADME.md:54-64
  • Modifies query_servers configuration via /_config to inject an OS commandREADME.md:109-113
  • Creates a design document with a view using the injected query server language to trigger command executionREADME.md:119-137
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command
curl -X PUT http://192.168.3.137:5984/_users/org.couchdb.user:hacker ...Demonstrates the CVE-2017-12635 privilege escalation exploit by creating a user with duplicate 'roles' keys.README.md:55-63
Command
curl -X PUT http://hacker:password123@192.168.3.137:5984/_config/query_servers/cmd ...Demonstrates the CVE-2017-12636 remote code execution exploit by registering a malicious query server.README.md:110-112
Command
docker exec project1-lab07-1 cat /tmp/pwnedVerification step to confirm the RCE payload executed inside the Docker container.README.md:151
Review boundaries

What the analysis did not establish

  • The artifact is a single README.md file containing a writeup; no executable exploit or scanner code is present.
  • The analysis_routing classification is NO_POC_CODE_IDENTIFIED, confirming the absence of PoC code.
  • Six non-text media files (images) are present but not analyzed, potentially containing additional visual evidence.
  • Only the README.md text file was reviewed; 6 non-text media files (images) were flagged as metadata-only and not analyzed. These images are referenced in the document as screenshots of command output and are unlikely to contain executable backdoor behavior, but their content was not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1