CVE-2021-38295 Privilege escalation vulnerability when using HTML attachments
A malicious user can execute JavaScript in an admin's browser via HTML attachments, leading to privilege escalation and database control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-38295?
CVE-2021-38295 is a high-severity cross-site scripting vulnerability in Apache CouchDB, published on 14 Oct 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2
Weakness: CWE-79
Which versions are affected by CVE-2021-38295?
1 open source package ship an affected version, including couchdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
couchdb Bitnami | All versions | 3.1.2 |
Products include Apache Couchdb.
How do I fix CVE-2021-38295?
Upgrade couchdb to 3.1.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-38295 being exploited?
There is no known exploitation of CVE-2021-38295 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache CouchDB
Sources
Also known as BIT-couchdb-2021-38295, GHSA-gr7p-9mx8-wr74, MGASA-2021-0520, UBUNTU-CVE-2021-38295.