=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN528
_____________________________________________________________________

DATE                : 12/10/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache CouchDB versions prior to
                                         3.1.2.

=====================================================================
https://docs.couchdb.org/en/stable/cve/2021-38295.html
_____________________________________________________________________


2.14. CVE-2021-38295: Apache CouchDB Privilege Escalation

Date:	        12.10.2021
Affected:       3.1.1 and below
Severity:       Low
Vendor:	        The Apache Software Foundation


2.14.1. Description

A malicious user with permission to create documents in a
database is able to attach a HTML attachment to a document.
If a CouchDB admin opens that attachment in a browser, e.g.
via the CouchDB admin interface Fauxton, any JavaScript code
embedded in that HTML attachment will be executed within the
security context of that admin. A similar route is available
with thealready deprecated `_show` and `_list` functionality.

This *privilege escalation* vulnerability allows an attacker
to add or remove data in any database or make configuration
changes.


2.14.2. Mitigation

CouchDB 3.2.0  and onwards adds `Content-Security-Policy`
headers for all attachment, `_show` and `_list` requests.
This breaks certain niche use-cases and there are
configuration options to restore the previous behaviour for
those who need it.

CouchDB 3.1.2 defaults to the previous behaviour, but adds
configuration options to turn `Content-Security-Policy` headers
on for all affected requests.


2.14.3. Credit

This issue was identified by Cory Sabol of Secure Ideas.


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================