CVE-2020-1955 Auth bypass in Apache CouchDB
An authentication bypass in Apache CouchDB allows unauthenticated access to all endpoints when a specific non-default configuration is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-1955?
CVE-2020-1955 is a critical authentication bypass vulnerability in Apache CouchDB, published on 20 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_up`. It was meant as an extension to the long standing setting `require_valid_user`, which in turn requires that any and all requests to CouchDB will have to be made with valid credentials, effectively forbidding any anonymous requests. The new `require_valid_user_except_for_up` is an off-by-default setting that was meant to allow requiring valid credentials for all endpoints except for the `/_up` endpoint. However, the implementation of this made an error that lead to not enforcing credentials on any endpoint, when enabled. CouchDB versions 3.0.1[1] and 3.1.0[2] fix this issue.
Weakness: CWE-306
Which versions are affected by CVE-2020-1955?
1 open source package ship an affected version, including couchdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
couchdb Bitnami | From 3.0.0 | 3.0.1 |
Products include Apache Couchdb.
How do I fix CVE-2020-1955?
Upgrade couchdb to 3.0.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-1955 being exploited?
There is no known exploitation of CVE-2020-1955 in the wild and no public exploit code.
Other vulnerabilities in Apache CouchDB
Sources
Also known as BIT-couchdb-2020-1955, GHSA-6625-2573-pv96.