Couchbase Server - Broken Access Control

criticalseverity

3.9%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit requires no special conditions.

Impact

Attackers can access and modify administrative settings, potentially leading to data tampering or system compromise.

Fix

Update to the latest version where the /settings REST endpoint requires authentication.

How to confirm it

Send: GET {{BaseURL}}/settings ; GET {{BaseURL}}/indexer/settings
Positive when: status_code == 200 and contains_any(body, 'indexer.settings','projector.settings','max_seckey_size')

Run it with nuclei: nuclei -id CVE-2020-9039 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-9039
info:
  name: Couchbase Server - Broken Access Control
  author: pussycat0x
  severity: critical
  description: |
    Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit requires no special conditions.
  impact:
    Attackers can access and modify administrative settings, potentially leading to data tampering or system compromise.
  remediation:
    Update to the latest version where the /settings REST endpoint requires authentication.
  reference:
    - https://docs.couchbase.com/server/current/index-rest-settings/index.html#Settings
  metadata:
    max-request: 2
    verified: false
    shodan-query: html:"Couchbase"
  tags: cve,cve2020,couchbase,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/settings"
      - "{{BaseURL}}/indexer/settings"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_any(body, 'indexer.settings','projector.settings','max_seckey_size')"
        condition: and

References

https://docs.couchbase.com/server/current/index-rest-settings/index.html#Settings

Use this check only on systems you are authorised to test. Where the data comes from