CVE-2022-24706
published 2022-04-26CVE-2022-24706: In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The…
PriorityP198critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-09-15
Exploited in the wild
EPSS
92.33%
99.8th percentile
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | couchdb | < 3.2.2 | 3.2.2 |
| apache_software_foundation | apache_couchdb | Apache CouchDB – 3.2.1 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes
00 15 72 01 02 03 04
bytes
8b f4 e6 ad dd 72 a9 c4 c4 71 47 08 d2 94 15 28
snort
alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Default Apache CouchDB Erlang Cookie Observed (CVE-2022-24706)"; flow:established,to_server; content:"|00 15|r|01 02 03 04|"; startswith; content:"|8b f4 e6 ad dd 72 a9 c4 c4 71 47 08 d2 94 15 28|"; fast_pattern; reference:cve,2022-24706; classtype:attempted-admin; sid:2036650; rev:1; metadata:attack_target Server, created_at 2022_05_23, cve CVE_2022_24706, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_05_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
bytes
name_msg: 00156e00050007499c4141414141414041414141414141
bytes
challenge_reply: 00157201020304
bytes
cmd: 0000006670836804610667770e41414141414140414141414141410000000300000000007700770372657883680267770e41414141414140414141414141410000000300000000006805770463616c6c77026f737703636d646c000000016b000269646a770475736572
- →Shodan query to identify exposed CouchDB EPMD instances: search for port 4369 with 'name couchdb at' banner ↗
- →Shodan queries to identify exposed CouchDB instances for targeting
- →Exploit flow: attacker connects to EPMD on port 4369, requests node list, then connects to the returned Erlang distribution port and authenticates using the default cookie 'monster' via MD5 challenge-response ↗
- →Detection trigger: look for the Erlang distribution challenge-reply message (bytes 00 15 72 01 02 03 04) at the start of a TCP stream to any server, combined with the default-cookie MD5 digest bytes
- →Nuclei template validates successful RCE by checking for 'uid', 'gid', and 'groups' strings in the response — monitor for these strings in Erlang distribution traffic
- ·The default Erlang cookie value 'monster' is the root cause of unauthenticated access; CouchDB 3.2.2 explicitly rejects this value at startup and requires operators to set a new cookie
- ·The vulnerability affects default (unsecured) CouchDB installations prior to 3.2.2; the EPMD port 4369 and Erlang distribution ports must be exposed to the attacker for exploitation ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
cisa·2022-08-25·CVSS 9.8
CVE-2022-24706 [CRITICAL] CWE-1188 Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Vulnerability: Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Affected: Apache CouchDB
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
Required Action: Apply updates per vendor instructions.
Notes: https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00; https://nvd.nist.gov/vuln/detail/CVE-2022-24706
Remediation Due Date: 2022-09-15
GHSA
GHSA-vxc9-8m8h-9cp6: In Apache CouchDB prior to 3
ghsa_unreviewed·2022-04-27
CVE-2022-24706 [CRITICAL] CWE-1188 GHSA-vxc9-8m8h-9cp6: In Apache CouchDB prior to 3
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
VulnCheck
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-24706 [CRITICAL] CWE-1188 Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
Affected: Apache CouchDB
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.countercraftsec.com/blog/active-exploitation-of-confluence-cve-2022-26134/; https://www.countercraftsec.com/blog/active-exploitation-of-apache-couchdb-cve-2022-24706/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf
Exploit PoC: https://vulncheck.com/xdb/b8f0f62ec11e; https://vuln
Suricata
ET EXPLOIT Default Apache CouchDB Erlang Cookie Observed (CVE-2022-24706)
suricata·2022-05-23·CVSS 9.8
CVE-2022-24706 [CRITICAL] ET EXPLOIT Default Apache CouchDB Erlang Cookie Observed (CVE-2022-24706)
ET EXPLOIT Default Apache CouchDB Erlang Cookie Observed (CVE-2022-24706)
Rule: alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Default Apache CouchDB Erlang Cookie Observed (CVE-2022-24706)"; flow:established,to_server; content:"|00 15|r|01 02 03 04|"; startswith; content:"|8b f4 e6 ad dd 72 a9 c4 c4 71 47 08 d2 94 15 28|"; fast_pattern; reference:cve,2022-24706; classtype:attempted-admin; sid:2036650; rev:1; metadata:attack_target Server, created_at 2022_05_23, cve CVE_2022_24706, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2022_05_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Exploit-DB
Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
exploitdb·2022-05-11·CVSS 9.8
CVE-2022-24706 [CRITICAL] Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
---
# Exploit Title: Apache CouchDB 3.2.1 - Remote Code Execution (RCE)
# Date: 2022-01-21
# Exploit Author: Konstantin Burov, @_sadshade
# Software Link: https://couchdb.apache.org/
# Version: 3.2.1 and below
# Tested on: Kali 2021.2
# Based on 1F98D's Erlang Cookie - Remote Code Execution
# Shodan: port:4369 "name couchdb at"
# CVE: CVE-2022-24706
# References:
# https://habr.com/ru/post/661195/
# https://www.exploit-db.com/exploits/49418
# https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/
# https://book.hacktricks.xyz/pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd#erlang-cookie-rce
#
#
#!/usr/local/bin/python3
import socket
from hashlib import md5
import struct
import sys
import re
import tim
Metasploit
Apache Couchdb Erlang RCE
metasploit
Apache Couchdb Erlang RCE
Apache Couchdb Erlang RCE
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges.
Nuclei
CouchDB Erlang Distribution - Remote Command Execution
nuclei·CVSS 9.8
CVE-2022-24706 [CRITICAL] CouchDB Erlang Distribution - Remote Command Execution
CouchDB Erlang Distribution - Remote Command Execution
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges.
Template:
id: CVE-2022-24706
info:
name: CouchDB Erlang Distribution - Remote Command Execution
author: Mzack9999,pussycat0x
severity: critical
description: |
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system.
remediation: |
Upgrade to versions 3.2.2 or newer. Starting from CouchDB 3.2.2, the previous default Erlang cookie value "monster" will be rejected
http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.htmlhttp://www.openwall.com/lists/oss-security/2022/04/26/1http://www.openwall.com/lists/oss-security/2022/05/09/1http://www.openwall.com/lists/oss-security/2022/05/09/2http://www.openwall.com/lists/oss-security/2022/05/09/3http://www.openwall.com/lists/oss-security/2022/05/09/4https://docs.couchdb.org/en/3.2.2/setup/cluster.htmlhttps://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcdhttp://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.htmlhttp://www.openwall.com/lists/oss-security/2022/04/26/1http://www.openwall.com/lists/oss-security/2022/05/09/1http://www.openwall.com/lists/oss-security/2022/05/09/2http://www.openwall.com/lists/oss-security/2022/05/09/3http://www.openwall.com/lists/oss-security/2022/05/09/4https://docs.couchdb.org/en/3.2.2/setup/cluster.htmlhttps://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcdhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706
2022-04-26
Published
2022-08-25
Added to CISA KEV
Exploited in the wild