CVE-2022-24706: Apache CouchDB Insecure Default Initialization of Resource Vulnerability

Reference Links

• http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html
• http://www.openwall.com/lists/oss-security/2022/04/26/1
• http://www.openwall.com/lists/oss-security/2022/05/09/1
• http://www.openwall.com/lists/oss-security/2022/05/09/2
• http://www.openwall.com/lists/oss-security/2022/05/09/3
• http://www.openwall.com/lists/oss-security/2022/05/09/4
• https://docs.couchdb.org/en/3.2.2/setup/cluster.html
• https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00
• https://medium.com/@_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
• https://exchange.xforce.ibmcloud.com/vulnerabilities/225177
• https://www.ibm.com/support/pages/node/7151122 (Advisory)
• https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd
• https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00;
• https://nvd.nist.gov/vuln/detail/CVE-2022-24706

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7151122

Frequently Asked Questions

• What is CVE-2022-24706?

  CVE-2022-24706 is a vulnerability in Apache CouchDB that allows an attacker to access an improperly secured default installation without authenticating and gain admin privileges.

• How severe is CVE-2022-24706?

  CVE-2022-24706 has a severity rating of 9.8 (Critical).

• How can an attacker exploit CVE-2022-24706?

  CVE-2022-24706 can be exploited by an attacker to gain admin privileges in an improperly secured default installation of Apache CouchDB, without the need for authentication.

• What are the affected software versions of CVE-2022-24706?

  The affected software versions of CVE-2022-24706 are Apache CouchDB up to version 3.2.2.

• How can I mitigate CVE-2022-24706?

  To mitigate CVE-2022-24706, it is recommended to properly secure your Apache CouchDB installation by following the CouchDB documentation's recommendations, such as using a firewall.