CVE-2022-24706: Remote Code Execution Vulnerability in Packaging
Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
Other sources
Apache CouchDB could allow a remote attacker to gain elevated privileges on the system, caused by improper access control to an improperly secured default installation. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain admin privileges to execute arbitrary code on the system.
— IBM
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.2.2 - Compensating control
Place a firewall in front of all Apache CouchDB installations to restrict external access and prevent unauthenticated access to default/unsecured installations.
Event History
Frequently Asked Questions
What is CVE-2022-24706?
CVE-2022-24706 is a vulnerability in Apache CouchDB that allows an attacker to access an improperly secured default installation without authenticating and gain admin privileges.
How severe is CVE-2022-24706?
CVE-2022-24706 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2022-24706?
CVE-2022-24706 can be exploited by an attacker to gain admin privileges in an improperly secured default installation of Apache CouchDB, without the need for authentication.
What are the affected software versions of CVE-2022-24706?
The affected software versions of CVE-2022-24706 are Apache CouchDB up to version 3.2.2.
How can I mitigate CVE-2022-24706?
To mitigate CVE-2022-24706, it is recommended to properly secure your Apache CouchDB installation by following the CouchDB documentation's recommendations, such as using a firewall.