couchdb-admin-party: CouchDB Admin Party

2025-08-01 CouchDB Admin Party PoC Public

Description

Requests made against CouchDB are done in the context of an admin user.

PoC

id: couchdb-admin-party

info:
  name: CouchDB Admin Party
  author: organiccrap
  severity: high
  verified: false
  description: |-
    Requests made against CouchDB are done in the context of an admin user.
  tags: couchdb,admin,party
  created: 2024/04/04

rules:
  r0:
    request:
      method: GET
      path: /_users/_all_docs
    expression: response.body.bcontains(b'total_rows') && response.body.bcontains(b'offset') && response.headers["server"].icontains("CouchDB/")
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/couchdb-admin-party.yaml

References

Related Vulnerabilities