Multiple vulnerabilities in Apache CouchDB
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2018-11769 CVE-2017-12636 CVE-2018-8007 |
| CWE-ID | CWE-20 CWE-78 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software Subscribe |
CouchDB Server applications / Database software |
| Vendor | Apache Foundation |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Privilege escalation
EUVDB-ID: #VU14323
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-11769
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote administrative attacker to gain elevated privileges on the target system.
The vulnerability exists due to insufficient validation of administrator-supplied configuration settings via the HTTP API. A remote attacker can bypass the blacklist of configuration settings that are not allowed to be modified via the HTTP API and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
MitigationUpdate to version 2.2.0.
Vulnerable software versionsCouchDB: 0.8.0 - 2.1.2
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) OS command injection
EUVDB-ID: #VU14324
Risk: High
CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]
CVE-ID: CVE-2017-12636
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote administrative attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can configure the database server via HTTP(S) that include(s) paths for operating system-level binaries that are subsequently launched by CouchDB to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Successful exploitation of the vulnerability may result in system compromise.
MitigationUpdate to version 1.7.0 or 2.1.1.
Vulnerable software versionsCouchDB: 0.8.0 - 2.1.0
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.
3) Privilege escalation
EUVDB-ID: #VU14325
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-8007
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote administrative attacker to gain elevated privileges on the target system.
The vulnerability exists due to insufficient validation of administrator-supplied configuration settings via the HTTP API. A remote attacker can bypass the blacklist of configuration settings that are not allowed to be modified via the HTTP API and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
MitigationUpdate to version 1.7.2 or 2.1.2.
Vulnerable software versionsCouchDB: 0.8.0 - 2.1.1
External linkshttp://blog.couchdb.org/2018/07/10/cve-2018-8007/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
