QID 731122

Date Published: 2024-02-08

QID 731122: Apache CouchDB Privilege Escalation Vulnerability

Apache CouchDB is a free open source document-oriented database written in the Erlang programming language.

Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.

Affected Versions:
Apache CouchDB versions prior to version 3.3.3

QID Detection Logic(Remote)
It checks for vulnerable version of Apache CouchDB by sending a GET request to the target and matches the vulnerable version.

Note: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers.

An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function.

CVSS V3 rated as Medium - 5.7 severity.

CVSS V2 rated as Low - 1.9 severity.

Solution

The vendor has already released the patch to fix the vulnerability. Customers are advised to upgrade to Apache CouchDB.Workaround:
Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers

Vendor References

Apache CouchDB Privilege Escalation - lists.apache.org/thread/pqjq9zt8vq9rsobkc1cow9sqm9vozlrg

CVEs related to QID 731122

CVE-2023-45725 |

Software Advisories

Advisory ID	Software	Component	Link
Apache CouchDB			couchdb.apache.org/

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].