⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2017-12635

Severity
9.8CRITICAL
EPSS
94.2%
top 0.08%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedNov 14
Latest updateJul 8

Description

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database s

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

NVDapache/couchdb< 1.7.0+1
CVEListV5apache_software_foundation/apache_couchdb1.2.0 to 1.6.1, 2.0.0 to 2.1.0+1

🔴Vulnerability Details

4
GHSA
GHSA-f3p2-qqmm-jg8f: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 12022-05-13
OSV
CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 12017-11-14
CVEList
CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 12017-11-14
VulnCheck
Apache CouchDB Improper Privilege Management2017

💥Exploits & PoCs

3
Exploit-DB
Apache CouchDB - Arbitrary Command Execution (Metasploit)2018-07-13
Exploit-DB
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation2018-04-23
Nuclei
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

🔍Detection Rules

3
Suricata
ET EXPLOIT Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation (CVE-2017-12635)2025-07-08
Suricata
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 12018-06-25
Suricata
ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12635)2018-03-19

💬Community

2
Bugzilla
CVE-2017-12635 couchdb: Privilege escalation via _users documents with duplicate keys for 'roles'2017-11-23
Bugzilla
CVE-2017-12635 CVE-2017-12636 couchdb: various flaws [fedora-all]2017-11-23
CVE-2017-12635 (CRITICAL CVSS 9.8) | Due to differences in the Erlang-ba | cvebase.io