Apache CouchDB Remote Code Execution Vulnerability via Insecure Default Configuration

A remote code execution vulnerability has been identified in Apache CouchDB versions prior to 3.2.2. The issue arises from an insecure default installation that allows an attacker to gain administrative privileges without authentication. This vulnerability exploits the CouchDB's use of Erlang's distribution protocol, taking advantage of a default 'cookie' value that authenticates communication between Erlang nodes. The problem is exacerbated by CouchDB opening a random network port for distributed operations, which can be accessed if not properly secured.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where CouchDB is running.

Reproduction

To reproduce this vulnerability, first identify a CouchDB installation that is running a version prior to 3.2.2 and is not behind a firewall. This can be done by scanning for CouchDB instances that have the default 'monster' cookie value, which is indicative of a vulnerable installation. Once a target is identified, connect to the Erlang Port Mapper Daemon (EPMD) on port 4369 to retrieve the dynamic port of the CouchDB node. After obtaining the node's port, connect to the Erlang server using the default cookie to gain administrative access, which can then be exploited for remote code execution.

Remediation

Upgrade to Apache CouchDB version 3.2.2 or later, and change the default Erlang cookie value. For installations that have already upgraded, ensure that the CouchDB distribution port is not exposed to external access.