Authorization and Session Cookie Exposure in Apache CouchDB
Summary
CVE-2023-45725: Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents. Affects couchdb versions < 3.3.3. Fixed in 3.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache CouchDB is an open-source NoSQL database that uses JSON for data storage, retrieval, and querying. It provides a RESTful HTTP API for interacting with the database. CouchDB is designed to be scalable, fault-tolerant, and easy to use. However, a vulnerability has been discovered in CouchDB that allows unauthorized access to user authorization and session cookie headers.
Vulnerability Detail
The vulnerability exists in the design document functions of CouchDB, specifically the 'list', 'show', 'rewrite', and 'update' functions. These functions receive a user HTTP request object and may inadvertently expose the user's authorization or session cookie headers. An attacker can exploit this vulnerability by inserting malicious design documents into the database and manipulating a user to access a function from that design document. The attacker can then leak the session component using HTML-like output, insert the session as an external resource, or store the credential in a _local document with an 'update' function. The impact of this vulnerability is the potential unauthorized access to sensitive user information.
How To Fix
Minimum fixed version
3.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, it is advised to avoid using design documents from untrusted sources that may attempt to access or manipulate request object headers.
Conclusion
The vulnerability in Apache CouchDB allows unauthorized access to user authorization and session cookie headers. It is crucial to upgrade to the latest version of CouchDB or apply the recommended workaround to mitigate the risk of unauthorized access to sensitive user information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for couchdb →
FAQ
Apache CouchDB is an open-source NoSQL database that uses JSON for data storage, retrieval, and querying. It provides a RESTful HTTP API for interacting with the database.
Design document functions in CouchDB are special functions defined in a design document that can be used to transform or filter data during retrieval or update operations.
An attacker can exploit this vulnerability by inserting malicious design documents into the database and manipulating a user to access a function from that design document. The attacker can then leak the session component using HTML-like output, insert the session as an external resource, or store the credential in a _local document with an 'update' function.
The impact of this vulnerability is the potential unauthorized access to sensitive user information, including authorization and session cookie headers.
To fix this vulnerability, it is recommended to upgrade to Apache CouchDB version 3.3.2 or later. This version includes a fix for the vulnerability and ensures that design document functions do not expose authorization or session cookie headers.
Related vulnerabilities
Recent vulnerabilities recorded for couchdb.
