PT-2022-21375 · Couchbase · Couchbase Sync Gateway

Published 2022-06-10 · Updated 2022-06-17 · CVE-2022-32563

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Couchbase Sync Gateway versions 3.0.0 through 3.0.1 Couchbase Sync Gateway version 3.0.2 is not affected, but versions prior to 3.0.2 are vulnerable, so the correct representation is: Couchbase Sync Gateway versions prior to 3.0.2

Description An issue was discovered in Couchbase Sync Gateway where admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue.

Recommendations For Couchbase Sync Gateway versions prior to 3.0.2, replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration as a workaround.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-32563

GHSA-9266-J9V3-Q4J5

PYSEC-2022-207

Affected Products

Couchbase Sync Gateway

References · 9

• https://forums.couchbase.com/tags/security · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9266-j9v3-q4j5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32563 · Security Note
• https://couchbase.com/alerts · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32563 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-207 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/couchbase/PYSEC-2022-207.yaml · Note
• https://t.me/cibsecurity/44177 · Telegram Post
• https://couchbase.com/alerts/#CVE-2022-32563 · Note