CVE-2017-12636

EPSS 90.6%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 90.6%KEV nãoPoC públicaNuclei —Metasploit simPatch referenciado

Lifecycle

06 Apr 2016Metasploit module available

14 Nov 2017Published on NVD

20 Jun 2018Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.

Affected products

Apache Software Foundation · Apache CouchDB

public PoCs found — 6

githubgithub.com/XTeam-Wing/CVE-2017-12636★ 6 githubgithub.com/moayadalmalat/CVE-2017-12636★ 3 cve_referencewww.exploit-db.com/exploits/44913/unverified cve_referencewww.exploit-db.com/exploits/45019/unverified exploitdbwww.exploit-db.com/exploits/45019unverified exploitdbwww.exploit-db.com/exploits/44913unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html https://security.gentoo.org/glsa/201711-16 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us https://www.exploit-db.com/exploits/44913/https://www.exploit-db.com/exploits/45019/