{"id":"CVE-2017-12636","published":"2017-11-14T20:00:00Z","modified":"2024-09-16T18:48:31Z","title":"CouchDB administrative users can configure the database server via HTTP(S)","vendor":"Apache Software Foundation","product":"Apache CouchDB","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache CouchDB","versions":["1.2.0 to 1.6.1","2.0.0 to 2.1.0"]}],"description":{"text":"CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache CouchDB has a flaw in which its HTTP(S) configuration interface lets administrative users set paths to operating system binaries that CouchDB later launches. An attacker who holds an admin account on an affected release (before 1.7.0 or 2.x before 2.1.1) can use this to run arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the internet.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:13Z"},"cvss":null,"epss":{"score":0.90602,"percentile":0.99801,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":7,"pulses":[{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"Vulnerabilities in Apache CouchDB Open the Door to Monero Miners","url":"https://otx.alienvault.com/pulse/65707ad2538285933007db2a","created":"2023-12-06"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"},{"name":"Log4j","url":"https://otx.alienvault.com/pulse/61df005d9f0ff216afd15bdc","created":"2022-01-12"},{"name":"Ransomware: Night Sky","url":"https://otx.alienvault.com/pulse/61deff0101737ee62817cbd7","created":"2022-01-12"},{"name":"Linux Servers Compromised to run CryptoCurrency Miners","url":"https://otx.alienvault.com/pulse/5b684817e47bd1512924817e","created":"2018-08-06"},{"name":"Vulnerabilities in Apache CouchDB Open the Door to Monero Miners","url":"https://otx.alienvault.com/pulse/5a8590085303276b6e113438","created":"2018-02-15"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/45019/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67%40%3Cdev.couchdb.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.exploit-db.com/exploits/44913/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://security.gentoo.org/glsa/201711-16","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03935en_us","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-4175","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-4175","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":44913,"url":"https://www.exploit-db.com/exploits/44913","title":"Apache CouchDB < 2.1.0 - Remote Code Execution","type":"webapps","platform":"linux","date":"2018-06-20","verified":true,"provenance":"source"},{"id":45019,"url":"https://www.exploit-db.com/exploits/45019","title":"Apache CouchDB - Arbitrary Command Execution (Metasploit)","type":"remote","platform":"linux","date":"2018-07-13","verified":true,"provenance":"source"},{"id":45019,"url":"https://www.exploit-db.com/exploits/45019","title":"Apache CouchDB - Arbitrary Command Execution (Metasploit)","type":"remote","platform":"linux","date":"2018-07-13","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2018-06-20"},"pocGithub":{"count":2,"skipped":0,"earliest":"2018-08-25","earliestUrl":"https://github.com/moayadalmalat/CVE-2017-12636","repos":[{"name":"XTeam-Wing/CVE-2017-12636","url":"https://github.com/XTeam-Wing/CVE-2017-12636","stars":6,"created":"2020-03-23"},{"name":"moayadalmalat/CVE-2017-12636","url":"https://github.com/moayadalmalat/CVE-2017-12636","stars":3,"created":"2018-08-25"}]},"metasploit":[{"name":"Apache CouchDB Arbitrary Command Execution","module":"exploit/linux/http/apache_couchdb_cmd_exec","type":"exploit","disclosureDate":"2016-04-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb"}],"first":{"date":"2016-04-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/45019/","https://www.exploit-db.com/exploits/44913/"],"flow":[],"timeline":[{"date":"2016-04-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2018-06-20, PoC-in-GitHub 2018-08-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_couchdb_cmd_exec.rb","provenance":"source"},{"date":"2017-11-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-12636","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":27.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 3 Exploit-DB entries; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-couchdb-cve-2017-12636","children":[{"from":"CVE-2017-12636","to":"CVE-2018-11769","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.","from":"CVE.org","in":"CVE-2018-11769"}]}]}}