PT-2022-2582 · Apache · Apache Couchdb

Alex Vandiver · Published 2022-04-26 · Updated 2025-08-15 · CVE-2022-24706

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions prior to 3.2.2

Description The issue concerns an improperly secured default installation of Apache CouchDB, allowing an attacker to access the system without authentication and gain admin privileges. The CouchDB documentation recommends properly securing an installation, including using a firewall in front of all CouchDB installations. It is estimated that a significant number of installations may be vulnerable, with reports suggesting around 80,000 results from a ZoomEye query and over 1,500 results from a Shodan search.

Recommendations For Apache CouchDB versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue. As a temporary workaround, consider using a firewall in front of the CouchDB installation to restrict access and minimize the risk of exploitation. Additionally, follow the recommendations in the CouchDB documentation for properly securing an installation.

Exploit

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

APACHECOUCHDB_CVE2022_24706

BDU:2022-03030

BIT-COUCHDB-2022-24706

CVE-2022-24706

MGASA-2022-0466

Affected Products

Apache Couchdb

References · 38

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_couchdb_erlang_rce.rb · Exploit
• 🔥 https://github.com/sadshade/CVE-2022-24706-CouchDB-Exploit · Exploit
• 🔥 https://medium.com/@_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd · Exploit
• 🔥❌ https://github.com/trhacknon/CVE-2022-24706-CouchDB-Exploit · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html · Exploit
• 🔥 https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd · Exploit
• 🔥 https://exploit-db.com/exploits/50914 · Exploit
• 🔥 http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html · Exploit
• 🔥❌ https://github.com/XmasSnowISBACK/CVE-2022-24706 · Exploit, Deleted
• http://openwall.com/lists/oss-security/2022/05/09/2 · Patch
• https://bdu.fstec.ru/vul/2022-03030 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24706 · Security Note
• http://openwall.com/lists/oss-security/2022/05/09/4 · Patch
• http://openwall.com/lists/oss-security/2022/05/09/3 · Patch
• https://osv.dev/vulnerability/MGASA-2022-0466 · Vendor Advisory