CVE-2017-12636 Command injection in Apache CouchDB
Administrative users can execute arbitrary shell commands via HTTP configuration options, allowing code execution as the CouchDB user.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12636?
CVE-2017-12636 is a high-severity command injection vulnerability in Apache CouchDB, published on 14 Nov 2017. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Weakness: CWE-78
Which versions are affected by CVE-2017-12636?
It affects 1 product.
Products include Apache Couchdb.
How do I fix CVE-2017-12636?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-12636 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-12636 exists.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries and 2 proofs of concept on GitHub.
Other vulnerabilities in Apache CouchDB
Sources
Also known as GHSA-fcpq-cj4x-h8mv, UBUNTU-CVE-2017-12636.