CVE-2022-24706
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
Description
CVE-2022-24706 is an insecure default initialization vulnerability in Apache CouchDB that allows an attacker to escalate to administrative privileges. The vulnerability exists because CouchDB ships with a default configuration that does not properly secure the Erlang distribution protocol cookie, enabling unauthenticated attackers to gain administrative access to the database. Apache CouchDB is a widely used open-source NoSQL document database, and compromised instances can expose all stored data and allow arbitrary command execution. CISA has added CVE-2022-24706 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.4% (99th percentile), exploitation is near-certain for exposed instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | couchdb | < 3.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/167032/Apache-CouchDB-3.2.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/169702/Apache-CouchDB-Erlang-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2022/04/26/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2022/05/09/1(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2022/05/09/2(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2022/05/09/3(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2022/05/09/4(Mailing List, Patch, Third Party Advisory)
- https://docs.couchdb.org/en/3.2.2/setup/cluster.html(Broken Link, Product)
- https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00(Mailing List, Vendor Advisory)
- https://medium.com/%40_sadshade/couchdb-erlang-and-cookies-rce-on-default-settings-b1e9173a4bcd(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24706(US Government Resource)
Weakness Type
CWE-1188: Initialization of a Resource with an Insecure Default
CVE-2022-24706 exploits an insecure default initialization weakness in Apache CouchDB, where the Erlang distribution protocol cookie is set to a known default value during installation. This cookie functions as a shared secret for inter-node communication, and when left at its predictable default, it allows any attacker who knows the default value to connect to the CouchDB Erlang runtime and execute arbitrary commands with the privileges of the CouchDB process.
Learn more: CWE-1188 — Initialization of a Resource with an Insecure Default
Impact Analysis
CVE-2022-24706 represents a critical risk to data security for organizations using Apache CouchDB. The vulnerability is remotely exploitable without authentication over the network, requiring no user interaction and involving low attack complexity. By leveraging the default Erlang cookie, an attacker can connect to the CouchDB Erlang distribution port and execute arbitrary Erlang code, which translates to operating system command execution with the privileges of the CouchDB service account. This grants full administrative access to all CouchDB databases and their contents, the ability to create, modify, or delete any data, OS-level command execution for lateral movement and persistence, and potential access to sensitive application data stored in the database. With an EPSS score of 94.4% (99th percentile), this vulnerability is among the most actively exploited across all known CVEs.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-24706 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 15, 2022. The EPSS score of 94.4% (99th percentile) reflects near-certain exploitation activity. The exploit technique is well-documented — connecting to the Erlang distribution port with the known default cookie value is trivial and requires minimal technical sophistication. Exploit scripts and tools targeting this vulnerability have been published in the security community. No specific ransomware campaigns are currently associated with this CVE, but compromised CouchDB instances have been targeted for data theft and cryptomining operations.
Remediation
- Apply Apache CouchDB updates immediately: Per the CISA KEV required action, apply updates per vendor instructions. Upgrade to CouchDB 3.2.2 or later, which addresses the insecure default initialization vulnerability.
- Change the Erlang cookie to a strong, unique value: Even after patching, explicitly set the Erlang cookie in the CouchDB configuration to a cryptographically random value. The cookie is typically stored in the .erlang.cookie file in the CouchDB data directory.
- Restrict access to the Erlang distribution port: Configure firewall rules to block external access to the Erlang distribution port (default 4369 for EPMD and dynamic ports for distribution). This port should never be exposed to untrusted networks.
- Bind CouchDB to trusted interfaces only: Configure CouchDB and the Erlang runtime to listen only on localhost or trusted internal network interfaces, preventing remote exploitation from the internet.
- Audit CouchDB databases for unauthorized access: Review CouchDB access logs and database contents for signs of unauthorized administrative access, data modification, or data exfiltration that may have occurred before patching.
Technical Details
CVE-2022-24706 is an insecure default initialization vulnerability in Apache CouchDB's use of the Erlang distribution protocol. CouchDB is built on the Erlang/OTP platform, which uses a cookie-based authentication mechanism for inter-node communication. When CouchDB is installed, the Erlang cookie — which serves as a shared secret for connecting to the Erlang runtime — is set to a known default value ("monster"). An attacker who knows this default value can connect to the CouchDB node's Erlang distribution port and authenticate as a trusted node. Once connected, the attacker can use the Erlang remote procedure call (RPC) mechanism to execute arbitrary Erlang functions, including os:cmd/1 for operating system command execution. This effectively grants the attacker shell access with the privileges of the CouchDB process user, bypassing all CouchDB authentication and authorization mechanisms entirely.
Frequently Asked Questions
Is CVE-2022-24706 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2022-24706 by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 94.4% (99th percentile) indicates near-certain exploitation for exposed instances. The default Erlang cookie value is publicly known, making exploitation trivial.
What products are affected by CVE-2022-24706?
CVE-2022-24706 affects Apache CouchDB versions prior to 3.2.2. All installations where the Erlang distribution cookie has not been changed from its default value and the Erlang distribution port is accessible are vulnerable.
How do I fix CVE-2022-24706?
Upgrade Apache CouchDB to version 3.2.2 or later. Additionally, change the Erlang cookie to a strong, unique random value and ensure the Erlang distribution port is not accessible from untrusted networks. Block port 4369 (EPMD) and Erlang distribution ports at the firewall.
How severe is CVE-2022-24706?
CVE-2022-24706 is a critical severity vulnerability that enables unauthenticated privilege escalation to full administrative access on Apache CouchDB. With an EPSS score of 94.4% (99th percentile), it is among the most actively exploited vulnerabilities. Successful exploitation grants complete database access and operating system command execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.