CVE-2022-24706 PoC — Remote Code Execution Vulnerability in Packaging

Source

https://github.com/sadshade/CVE-2022-24706-CouchDB-Exploit

Associated Vulnerability

Title:Remote Code Execution Vulnerability in Packaging (CVE-2022-24706)
Description:In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

Description

Apache CouchDB 3.2.1 - Remote Code Execution (RCE)

Readme

# Apache CouchDB 3.2.1 - Remote Code Execution (RCE) CVE-2022-24706

Date: 2022-01-21

Exploit Author: Konstantin Burov, @_sadshade

Software Link: https://couchdb.apache.org/

Version: 3.2.1 and below

Tested on: Kali 2021.2

Based on 1F98D's Erlang Cookie - Remote Code Execution

Shodan: port:4369 "name couchdb at"

CVE: CVE-2022-24706

References:

https://habr.com/ru/post/661195/

https://www.exploit-db.com/exploits/49418

https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/

https://book.hacktricks.xyz/pentesting/4369-pentesting-erlang-port-mapper-daemon-epmd#erlang-cookie-rce

File Snapshot


 [4.0K]  /data/pocs/2fd36650ef6fe9b5171d3de030980fbe55cca3f1
├── [4.3K]  CVE-2022-24706-Exploit.py
└── [ 617]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!