Vulnerability record · CVE-2017-12635 · published 14 November 2017
CVE-2017-12635: Apache CouchDB privilege escalation via duplicate JSON roles keys
Apache · Couchdb
Apache CouchDB before 1.7.0 and 2.x before 2.1.1 parses JSON differently in its Erlang and JavaScript layers, so a _users document containing duplicate 'roles' keys is authorized using the second key but stored using the first. This lets a non-admin user assign themselves the '_admin' role, and combined with CVE-2017-12636 it can lead to remote code execution as the database system user.
Description
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no privileges or interaction required, near-maximum EPSS, and public exploit code, and it chains to remote code execution.
What it is
Apache CouchDB before 1.7.0 and 2.x before 2.1.1 parses JSON differently in its Erlang and JavaScript layers, so a _users document containing duplicate 'roles' keys is authorized using the second key but stored using the first. This lets a non-admin user assign themselves the '_admin' role, and combined with CVE-2017-12636 it can lead to remote code execution as the database system user.
Impact
An attacker gains administrative privileges on the CouchDB instance, and when chained with CVE-2017-12636, arbitrary shell command execution as the database system user.
Attack surface
Reachable over the network via the CouchDB HTTP API by submitting a crafted _users document; the CVSS vector shows no privileges or user interaction required, though the description frames the actor as a non-admin user.
Exploitation
Not listed in CISA KEV, but EPSS is 0.99838 (99.96th percentile) and public Exploit-DB entries 44498 and 45019 exist, indicating mature public exploitation.
What to do
- Upgrade Apache CouchDB to 1.7.0 or 2.1.1 or later, which fixes the parser discrepancy.
- Restrict network access to the CouchDB HTTP API to trusted hosts only.
- Audit _users documents for duplicate 'roles' keys or unexpected '_admin' assignments and remove them.
- Apply the CVE-2017-12636 fix as well, since the two are commonly chained for code execution.
Detection
- Monitor CouchDB logs and HTTP requests for PUT/POST to _users with duplicate 'roles' keys in the JSON body.
- Alert on creation or modification of users holding the '_admin' role outside approved change windows.
- Review _users database documents for anomalous role assignments and unexpected admin accounts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-12635 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-12635), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
