exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 2 of 2

Files from Max Justicz

CouchDB Enum Utility

Posted Aug 31, 2024

Authored by Roberto S. Soares, Max Justicz, Green-m, Hendrik Van Belleghem | Site metasploit.com

This Metasploit module enumerates databases on CouchDB using the REST API (without authentication by default).

tags | exploit

advisories | CVE-2017-12635

SHA-256 | 2942d69e8cd376e67d7cb3531714d06e9b22d6dd3d9fe3f3f432e8930a09dad3

Download | Favorite | View

Apache CouchDB Arbitrary Command Execution

Posted Jul 12, 2018

Authored by Max Justicz, Joan Touzet | Site metasploit.com

CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.

tags | exploit, web, arbitrary, shell

advisories | CVE-2017-12635, CVE-2017-12636

SHA-256 | a93f10ff77a858d80ea8ceaf2de3218d932d08cd6154f36a815a8470659052df

Download | Favorite | View