PT-2017-12615 · Apache · Apache Couchdb

Joan Touzet · Published 2017-11-14 · Updated 2019-05-13 · CVE-2017-12636

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions prior to 1.7.0 Apache CouchDB versions 2.x prior to 2.1.1

Description The issue allows an admin user to execute arbitrary shell commands as the CouchDB user. This can be achieved by configuring the database server via HTTP(S) and specifying paths for operating system-level binaries that are subsequently launched by CouchDB. The admin user can also download and execute scripts from the public internet.

Recommendations For Apache CouchDB versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. For Apache CouchDB versions 2.x prior to 2.1.1, update to version 2.1.1 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-12636

DLA-1252-1

SUSE-SU-2018:2578-1

Affected Products

Apache Couchdb

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb · Exploit
• 🔥 https://github.com/XTeam-Wing/CVE-2017-12636 · Exploit
• 🔥 https://github.com/RedTeamWing/CVE-2017-12636 · Exploit
• 🔥 https://exploit-db.com/exploits/45019 · Exploit
• 🔥 https://exploit-db.com/exploits/44913 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-12636 · Security Note
• https://ubuntu.com/security/CVE-2017-12636 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-12636 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:2578-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201711-16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12636 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12636 · Vendor Advisory
• https://suse.com/security/cve/CVE-2018-8007 · Note
• http://openwall.com/lists/oss-security/2017/11/14/6 · Note
• https://bugzilla.suse.com/1100973 · Note