CouchDB Admin Default - Detect
CouchDB is susceptible to requests in the context of an admin user.
CouchDBPoC 已收录
CVSS7.5
共找到 6 条公开漏洞记录
CouchDB is susceptible to requests in the context of an admin user.
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges.
Apache CouchDB是美国阿帕奇（Apache）软件基金会的一个免费、开源、面向文档的数据库，是一个使用JSON作为存储格式，JavaScript作为查询语言，MapReduce和HTTP作为API的NoSQL数据库。 Apache CouchDB 1.7.0之前的版本和2.1.1之前的2.x版本中存在远程代码执行漏洞。攻击者可利用该漏洞执行任意的shell命令（包括：从公共网络上下载和执行脚本）。
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keysfor 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behavior that if two 'roles' keys are available in the JSON, the second one will be used for authorizing the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.