CVE-2021-38295: Privilege escalation vulnerability when using HTML attachments
Apache CouchDB could allow a remote attacker to gain elevated privileges on the system, caused by improper input validation. By persuading a victim to open specially-crafted content, an authenticated attacker could exploit this vulnerability to gain elevated privileges to add or remove data in any database or make configuration changes.
Other sources
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated show and list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.1.2 - Compensating control
Avoid having a CouchDB admin open/preview HTML attachments in a browser (e.g., via the CouchDB admin interface Fauxton), since any JavaScript embedded in the HTML attachment can execute in the admin’s security context.
Event History
Frequently Asked Questions
What is CVE-2021-38295?
CVE-2021-38295 is a vulnerability in Apache CouchDB that allows a malicious user to execute JavaScript code by attaching a specially crafted HTML document to a database.
What is the severity of CVE-2021-38295?
The severity of CVE-2021-38295 is high, with a CVSS score of 7.3.
Which software is affected by CVE-2021-38295?
Apache CouchDB versions up to and excluding 3.1.2 are affected by CVE-2021-38295.
How does CVE-2021-38295 exploit work?
A malicious user with permission to create documents in a database can attach an HTML document containing JavaScript code. When a CouchDB admin opens this attachment, the embedded JavaScript code gets executed.
How can I fix CVE-2021-38295?
To fix CVE-2021-38295, update Apache CouchDB to version 3.1.2 or higher.