CVE-2022-24706
About
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Rainforest analyst review
In a default Apache CouchDB install before 3.2.2, the underlying Erlang node interface is reachable and protected only by a well-known default cluster secret. An attacker who can talk to that distribution port is treated as a trusted peer node, and from there reaches CouchDB with administrative privileges without ever authenticating — no login, and code execution as the CouchDB service account follows. The documentation always warned operators to firewall the service, but the insecure default did the damage on its own.
CouchDB backs a great many web and mobile applications as their document store, and an instance left on default settings and exposed to the network hands over the entire database plus a foothold on the host. The fix stops binding that interface openly and forces proper secrets, but the exposure is a configuration problem as much as a code one. Upgrade to 3.2.2 or later, bind the Erlang distribution port to localhost or firewall it, and set a strong node cookie and admin credentials rather than relying on the network perimeter.
References
- http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
- http://www.openwall.com/lists/oss-security/2022/04/26/1
- http://www.openwall.com/lists/oss-security/2022/05/09/1
- http://www.openwall.com/lists/oss-security/2022/05/09/2
- http://www.openwall.com/lists/oss-security/2022/05/09/3
- http://www.openwall.com/lists/oss-security/2022/05/09/4
- https://docs.couchdb.org/en/3.2.2/setup/cluster.html
- https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
- https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706
Related CVEs
Frequently asked questions
What is CVE-2022-24706?
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
How severe is CVE-2022-24706?
CVE-2022-24706 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2022-24706 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2022-24706?
Public advisories list the following as affected: couchdb. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-24706?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.