Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Title source: nucleiExploitation Summary
CVE-2017-12635 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 7 public exploits from researchers including Metasploit, r4wd3r, assalielmehdi, including a Metasploit module auxiliary/scanner/couchdb/couchdb_enum.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2017-12636 in Apache CouchDB, allowing arbitrary command execution by leveraging misconfigured query servers. It includes an authentication bypass (CVE-2017-12635) to gain admin privileges.
Description
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
Exploits (7)
This Metasploit module exploits CVE-2017-12636 in Apache CouchDB, allowing arbitrary command execution by leveraging misconfigured query servers. It includes an authentication bypass (CVE-2017-12635) to gain admin privileges.
This exploit leverages CVE-2017-12635 to create an admin user in Apache CouchDB by sending a crafted PUT request to the _users endpoint. It bypasses authentication by exploiting improper validation of user roles.
This PoC demonstrates a privilege escalation vulnerability in Apache CouchDB (CVE-2017-12635) by exploiting a discrepancy between Erlang and JavaScript JSON parsers. The attack involves submitting a user document with duplicate 'roles' keys to bypass validation and escalate to admin privileges.
This PoC demonstrates a vertical privilege escalation vulnerability in Apache CouchDB (CVE-2017-12635) by exploiting a discrepancy in JSON parsing between Erlang and JavaScript. It allows an unauthenticated attacker to create an admin user by sending a crafted HTTP request with duplicate 'roles' fields.
This repository provides a detailed technical analysis of CVE-2017-12635 and CVE-2017-12636, including step-by-step exploitation of privilege escalation and remote code execution in Apache CouchDB 1.6.0. It includes proof-of-concept commands and verification steps.
This Metasploit module enumerates CouchDB databases and server information via the REST API, with optional user creation for vulnerable versions. It does not contain offensive payloads but checks for CVE-2017-12635.
This Metasploit module exploits CVE-2017-12635 and CVE-2017-12636 in Apache CouchDB to achieve remote command execution by leveraging authentication bypass and misconfigured query server paths. It supports both CouchDB 1.x and 2.x versions.
Nuclei Templates (1)
product:"couchdb" || cpe:"cpe:2.3:a:apache:couchdb"
References (7)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H