Apache CouchDB sets weak file permissions potentially allowing 'Standard' Windows users to elevate privileges. The "nssm.exe" (Apache CouchDB) executable can be replaced by a 'Standard' non administrator user, allowing them to add a backdoor Administrator account once the "Apache CouchDB" service is restarted or system rebooted. As Apache CouchDB runs as LOCALSYSTEM, standard users can now execute arbitrary code with the privileges of the SYSTEM. Version 2.0.0 is affected.
68b1e098eddc65e76ee3877ef1fec35d1f90f759cb3fda181fd4c2b03a67aedf
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed