CVE-2017-12635

Related Files

Apache CouchDB Arbitrary Command Execution

Posted Jul 12, 2018

Authored by Max Justicz, Joan Touzet | Site metasploit.com

CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.

tags | exploit, web, arbitrary, shell

advisories | CVE-2017-12635, CVE-2017-12636

SHA-256 | a93f10ff77a858d80ea8ceaf2de3218d932d08cd6154f36a815a8470659052df

Download | Favorite | View

Apache CouchDB 1.7.0 / 2.x Remote Privilege Escalation

Posted Apr 23, 2018

Authored by Sebastian Castro

Apache CouchDB versions 1.7.0 and 2.x before 2.1.1 suffer from a remote privilege escalation vulnerability.

tags | exploit, remote

advisories | CVE-2017-12635

SHA-256 | 525d67ae1bd8cce85c38aefe50c57f261d94efb9be445529a511817757bd7d95

Download | Favorite | View

Gentoo Linux Security Advisory 201711-16

Posted Nov 20, 2017

Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201711-16 - Multiple vulnerabilities have been found in CouchDB, the worst of which could lead to the remote execution of arbitrary shell commands. Versions less than 1.7.1 are affected.

tags | advisory, remote, arbitrary, shell, vulnerability

systems | linux, gentoo

advisories | CVE-2017-12635, CVE-2017-12636

SHA-256 | 1637e4fbe6d399b8b711ad956330ad1c1baaed2b7f7cef8cb47f94e57500c620

Download | Favorite | View