CVE-2017-12635observed exploitation

CVE-2017-12635: vulnerability in Apache CouchDB

Published · Updated

Follow this CVE+ Monitor Apache CouchDB

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 100%
from disclosure to weapon160 days
Published on NVDNov 14
1st PoC+160d
metasploitApr 6
VulnCheck+2194d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
Affected products
Apache Software Foundation · Apache CouchDB
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache CouchDB

In the same product, most dangerous first.

CVE-2022-24706CRITICALRemote Code Execution Vulnerability in PackagingEPSS 92.5%KEVCVE-2017-12636—CVE-2017-12636EPSS 90.6%CVE-2018-8007—CVE-2018-8007EPSS 12.2%CVE-2018-11769—CVE-2018-11769EPSS 8.4%CVE-2021-38295—Privilege escalation vulnerability when using HTML attachmentsEPSS 3.7%CVE-2018-17188—CVE-2018-17188EPSS 3.6%