PT-2017-3321 · Apache · Apache Couchdb

Max Justicz · Published 2017-11-14 · Updated 2019-10-03 · CVE-2017-12635

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions prior to 1.7.0 Apache CouchDB versions 2.x prior to 2.1.1

Description The issue is related to differences in the Erlang-based JSON parser and JavaScript-based JSON parser in Apache CouchDB. This can allow a remote attacker, who is not an administrator, to gain access to execute arbitrary shell commands on the server with administrator privileges. The vulnerability enables non-admin users to assign themselves admin roles by submitting users documents with duplicate keys for 'roles' used for access control within the database.

Recommendations For Apache CouchDB versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. For Apache CouchDB versions 2.x prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the users document and limiting the ability of non-admin users to assign themselves roles until a patch is available.

Exploit

Fix

RCE

Improper Privilege Management

Weakness Enumeration

CWE-264

CWE-269

Related Identifiers

BDU:2018-00086

CVE-2017-12635

DLA-1252-1

Affected Products

Apache Couchdb

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/couchdb/couchdb_enum.rb · Exploit
• 🔥 https://github.com/assalielmehdi/CVE-2017-12635 · Exploit
• 🔥 https://exploit-db.com/exploits/44498 · Exploit
• 🔥 https://exploit-db.com/exploits/45019 · Exploit
• https://cve.org/CVERecord?id=CVE-2017-12635 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12635 · Security Note
• https://security.gentoo.org/glsa/201711-16 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12635 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12635 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12635 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00086 · Security Note
• https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E · Note
• https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html · Note
• http://openwall.com/lists/oss-security/2017/11/14/6 · Note