Arch Linux Security Advisory ASA-201711-24

Severity: High
Date : 2017-11-16
CVE-ID : CVE-2017-12635 CVE-2017-12636
Package : couchdb
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-495

Summary

The package couchdb before version 2.1.1-1 is vulnerable to multiple
issues including privilege escalation and arbitrary command execution.

Resolution

Upgrade to 2.1.1-1.

pacman -Syu “couchdb>=2.1.1-1”

The problems have been fixed upstream in version 2.1.1.

Workaround

None.

Description

• CVE-2017-12635 (privilege escalation)

Due to differences in the Erlang-based JSON parser and JavaScript-based
JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x
before 2.1.1 to submit _users documents with duplicate keys for ‘roles’
used for access control within the database, including the special case
‘_admin’ role, that denotes administrative users. In combination with
CVE-2017-12636 (remote command execution), this can be used to give
non-admin users access to arbitrary shell commands on the server as the
database system user. The JSON parser differences result in behaviour
that if two ‘roles’ keys are available in the JSON, the second one will
be used for authorising the document write, but the first ‘roles’ key
is used for subsequent authorization for the newly created user. By
design, users can not assign themselves roles. The vulnerability allows
non-admin users to give themselves admin privileges.

• CVE-2017-12636 (arbitrary command execution)

CouchDB administrative users can configure the database server via
HTTP(S). Some of the configuration options include paths for operating
system-level binaries that are subsequently launched by CouchDB. This
allows an admin user in Apache CouchDB before 1.7.0 and 2.x before
2.1.1 to execute arbitrary shell commands as the CouchDB user,
including downloading and executing scripts from the public internet.

Impact

A remote authenticated non-admin user is able to escalate privileges
and execute arbitrary commands on the affected host.

References

https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@<dev.couchdb.apache.org>
https://justi.cz/security/2017/11/14/couchdb-rce-npm.html
https://github.com/apache/couchdb/commit/e01f3009b59a00d81dd1f6d4e807afab08b2d072
https://github.com/apache/couchdb/commit/da27d4dcc7a98c76486f97c356f1c0f4a614b48b
https://security.archlinux.org/CVE-2017-12635
https://security.archlinux.org/CVE-2017-12636