oss-security - CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <a388a13c-2f49-a36d-668a-633583013717@apache.org>
Date: Tue, 26 Apr 2022 08:44:41 +0000
From: Jan Lehnardt <jan@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2022-24706: Apache CouchDB: Remote Code Execution
 Vulnerability in Packaging 

Severity: critical

Description:

An attacker can access an improperly secured default installation without
authenticating and gain admin privileges.

1. CouchDB opens a random network port, bound to all available interfaces
   in anticipation of clustered operation and/or runtime introspection. A
   utility process called `epmd` advertises that random port to the network.
   `epmd` itself listens on a fixed port.
2. CouchDB packaging previously chose a default `cookie` value for single-node
   as well as clustered installations. That cookie authenticates any
   communication between Erlang nodes.

The CouchDB documentation[1] has always made recommendations for properly
securing an installation, but not all users follow the advice.

We recommend a firewall in front of all CouchDB installations. The full
CouchDB api is available on registered port `5984` and this is the only
port that needs to be exposed for a single-node install. Installations
that do not expose the separate distribution port to external access are
not vulnerable.

[1]: https://docs.couchdb.org/en/stable/setup/cluster.html

Mitigation:

CouchDB 3.2.2 and onwards will refuse to start with the former default
Erlang cookie value of `monster`. Installations that upgrade to this
versions are forced to choose a different value.

In addition, all binary packages have been updated to bind `epmd` as
well as the CouchDB distribution port to `127.0.0.1` and/or `::1`
respectively.

Credit:

The Apache CouchDB Team would like to thank Alex Vandiver <alexmv@...ip.com> for the report of this issue.

References:

https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.