Authorization Bypass via JSON Parser Differential in Apache CouchDB

This repository is a small standalone Python exploit for Apache CouchDB targeting CVE-2017-12635 and CVE-2017-12636. It contains three files: a README with usage/examples, a requirements file, and a single executable script, couchdb-exploit.py, which is the main entry point. The exploit is not part of a larger framework. Its workflow is straightforward: it builds an HTTP base URL from a user-supplied target and port, then attempts to exploit the CouchDB duplicate-JSON-key parsing issue by sending a crafted user document to the _users database. The payload uses duplicate roles fields so that one parser sees the _admin role while another stores a benign-looking structure, resulting in creation of an administrative user with hardcoded credentials darabium / pwned@123. After creating the admin user, the script verifies success by requesting /_all_dbs with HTTP Basic Auth. If successful, it drops into an interactive shell-like interface. Based on the README and visible code, the shell supports database enumeration, viewing full database contents, showing raw responses, counting documents, searching across databases, executing arbitrary system commands, and triggering a reverse shell. The code also maintains a local command history and attempts cleanup on exit by deleting the created admin user and the temporary rce_test database. For code execution, the script uses authenticated CouchDB administrative functionality associated with CVE-2017-12636. It creates a temporary database and a malicious design document under /rce_test/_design/rce, then triggers the view endpoint /rce_test/_design/rce/_view/myview to cause command execution on the host. The reverse-shell feature appears to construct a shell command using attacker-supplied IP and port and then trigger it through the same design-document/view mechanism. Notable observables include the hardcoded credentials, the temporary database name rce_test, and the design document/view path used for execution. The exploit is operational rather than a mere proof of concept because it includes end-to-end exploitation logic and post-exploitation capabilities, but it is still relatively basic and hardcoded rather than highly modular or framework-driven.

This repository contains a single Metasploit module (modules/exploits/linux/http/apache_couchdb_cmd_exec.rb) that exploits two vulnerabilities (CVE-2017-12635 and CVE-2017-12636) in Apache CouchDB versions prior to 1.7.0 and 2.x prior to 2.1.1. The exploit targets the HTTP(S) administrative interface of CouchDB, abusing JSON parser inconsistencies and query server configuration to achieve arbitrary command execution as the CouchDB user. The module supports both authentication bypass (via crafted JSON) and authenticated exploitation, and delivers payloads using Metasploit's command stager (curl/wget) to a writable directory (default: /tmp). The default payload is a reverse shell, but any compatible Metasploit payload can be used. The exploit is weaponized, reliable, and leverages several HTTP endpoints and file paths during exploitation. The repository is structured as a typical Metasploit module, with all logic contained in a single Ruby file.