what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Max Justicz

Apache CouchDB Arbitrary Command Execution

Posted Jul 12, 2018

Authored by Max Justicz, Joan Touzet | Site metasploit.com

CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.

tags | exploit, web, arbitrary, shell

advisories | CVE-2017-12635, CVE-2017-12636

SHA-256 | a93f10ff77a858d80ea8ceaf2de3218d932d08cd6154f36a815a8470659052df

Download | Favorite | View