Unauthenticated RCE via Default Erlang Cookie in Apache CouchDB <3.2.2

This repository is a small proof-of-concept exploit for CVE-2022-24706 affecting Apache CouchDB. It contains three files: a README describing the vulnerability and reproduction steps, a docker-compose lab that starts a vulnerable CouchDB 3.2.1 instance, and the main exploit script poc.py. The exploit is a standalone Python script, not tied to a major exploitation framework. The core capability is remote command execution over the Erlang distribution protocol. The script first connects to the target's EPMD service on a user-supplied port (typically 4369) and sends an Erlang node-list request packet to enumerate available nodes and extract the active Erlang distribution port. It then connects to that discovered node port, performs the Erlang handshake, derives a challenge response using the hardcoded default cookie 'monster', and if authentication succeeds, enters an interactive loop. In that loop it wraps operator-provided commands into an Erlang RPC payload that calls os:cmd on the remote node and prints the returned output. The exploit is operational rather than a simple detector because it performs full authentication and arbitrary command execution. It assumes the target is vulnerable because the Erlang cookie remains at the default value and the Erlang distribution services are reachable from the attacker. The docker-compose file exposes ports 5984, 4369, and 9100 to make local testing easy; however, the script itself dynamically discovers the actual Erlang node port through EPMD rather than assuming 9100. Overall, the repository's purpose is to demonstrate and reproduce unauthenticated-to-authenticated remote code execution against exposed CouchDB Erlang distribution services when the default cookie is unchanged.

This repository contains a single Metasploit module (modules/exploits/multi/http/apache_couchdb_erlang_rce.rb) that exploits CVE-2022-24706, a remote code execution vulnerability in Apache CouchDB prior to version 3.2.2. The exploit targets the Erlang distribution protocol, leveraging the default cookie ('monster') to authenticate and execute arbitrary commands on the target system. The module supports multiple payload types, including command execution and staged payloads (reverse shells, Meterpreter, PowerShell stagers) for both Windows and Linux platforms. The exploit operates over the network, connecting to the Erlang Port Mapper Daemon (EPMD) on TCP port 4369 to enumerate and attack Erlang nodes. The code is weaponized, allowing for easy payload customization and reliable exploitation. The repository is structured as a typical Metasploit module, with all logic contained in a single Ruby file.

This repository contains a Python exploit script (CVE-2022-24706-Exploit.py) targeting Apache CouchDB versions 3.2.1 and below, exploiting CVE-2022-24706. The exploit leverages the Erlang distribution protocol (EPMD, default port 4369) and the default Erlang cookie ('monster') to authenticate to the CouchDB node and execute arbitrary system commands remotely. The script first connects to the EPMD service to enumerate available Erlang nodes and their ports, then authenticates using the default cookie, and finally allows the attacker to interactively send system commands to be executed on the target. The README provides context, references, and usage notes. The exploit is operational, requiring the target to expose EPMD and use the default cookie, and provides full remote code execution capabilities.