CVE-2023-45725 Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents
Attackers can steal session cookies from design document functions, potentially leading to account takeover if they can insert malicious documents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-45725?
CVE-2023-45725 is a medium-severity vulnerability in Apache CouchDB, published on 13 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.
These design document functions are: * list * show * rewrite * update
An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function.
For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document.
Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers
Weakness: CWE-200
Which versions are affected by CVE-2023-45725?
1 open source package ship an affected version, including couchdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
couchdb Bitnami | All versions | 3.3.3 |
Products include Apache Couchdb.
How do I fix CVE-2023-45725?
Upgrade couchdb to 3.3.3 or later.
Is CVE-2023-45725 being exploited?
There is no known exploitation of CVE-2023-45725 in the wild and no public exploit code.
Other vulnerabilities in Apache CouchDB
Sources
Also known as BIT-couchdb-2023-45725, GHSA-rmfx-8gmj-c39q, UBUNTU-CVE-2023-45725.