Cross-site scripting (XSS) vulnerability in the Futon UI in Apache CouchDB before 1.0.4, 1.1.x before 1.1.2, and 1.2.x before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite.

Jan Lehnardt reports :

Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user.

Versions of CouchDB earlier than 1.0.4, 1.1.x earlier than 1.1.2 or 1.2.x earlier than 1.2.1. It is therefore potentially affected by the following vulnerabilities :

  - An unspecified error exists in the included MochiWeb HTTP library that can allow access to arbitrary files via directory traversal attacks. Note that reportedly, this issue only affects installs on Windows hosts. (CVE-2012-5641)

  - An error related to JSONP callbacks can allow an unspecified cross-site scripting attack. (CVE-2012-5649)

  - An input validation error exists related to unspecified query parameters and the Futon UI that can allow DOM-based cross-site scripting attacks. (CVE-2012-5650)

The remote host is running CouchDB, a document-oriented database.  

Versions of CouchDB earlier than 1.0.4, 1.1.x earlier than 1.1.2 or 1.2.x earlier than 1.2.1. It is therefore potentially affected by the following vulnerabilities :

  - An unspecified error exists in the included MochiWeb HTTP library that can allow access to arbitrary files via directory traversal attacks. Note that reportedly, this issue only affects installs on Windows hosts. (CVE-2012-5641)

  - An error related to JSONP callbacks can allow an unspecified cross-site scripting attack. (CVE-2012-5649)

  - An input validation error exists related to unspecified query parameters and the Futon UI that can allow DOM-based cross-site scripting attacks. (CVE-2012-5650)

Updated couchdb packages fix security vulnerabilities :

A security flaw was found in the way Apache CouchDB, a distributed,fault- tolerant and schema-free document-oriented database accessible via a RESTful HTTP/JSON API, processed certain JSON callback. A remote attacker could provide a specially crafted JSON callback that, when processed could lead to arbitrary JSON code execution via Adobe Flash (CVE-2012-5649).

A DOM based cross-site scripting (XSS) flaw was found in the way browser- based test suite of Apache CouchDB, a distributed, fault-tolerant and schema-free document-oriented database accessible via a RESTful HTTP/JSON API, processed certain query parameters. A remote attacker could provide a specially crafted web page that, when accessed could lead to arbitrary web script or HTML execution in the context of a CouchDB user session (CVE-2012-5650).

- Ver. 1.2.1 (security bugfix release)

    - Unbundle snappy (see rhbz #871149)

    - Add _isa to the Requires

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of CouchDB running on the remote host is earlier than 1.0.4, 1.1.x earlier than 1.1.2 or 1.2.x earlier than 1.2.1.  It is, therefore, potentially affected by the following vulnerabilities :

  - An unspecified error exists in the included MochiWeb     HTTP library that can allow access to arbitrary files     via directory traversal attacks. Note that reportedly,     this issue only affects installs on Windows hosts.
    (CVE-2012-5641)

  - An error related to JSONP callbacks can allow an     unspecified cross-site scripting attack. (CVE-2012-5649)

  - An input validation error exists related to unspecified     query parameters and the Futon UI that can allow DOM-     based cross-site scripting attacks. (CVE-2012-5650)

Note that Nessus did not actually test for these flaws but instead, has relied on the version in CouchDB's banner.

ID	Name	Product	Family	Severity
66630	FreeBSD : couchdb -- DOM based XSS via Futon UI (4fb45a1c-c5d0-11e2-8400-001b216147b0)	Nessus	FreeBSD Local Security Checks	medium
800632	Apache CouchDB < 1.0.4 / 1.1.2 / 1.2.1 Multiple Vulnerabilities	Log Correlation Engine	Database	medium
6796	Apache CouchDB < 1.0.4 / 1.1.2 / 1.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Database	low
66081	Mandriva Linux Security Advisory : couchdb (MDVSA-2013:067)	Nessus	Mandriva Local Security Checks	medium
64413	Fedora 17 : couchdb-1.2.1-2.fc17 (2013-1387)	Nessus	Fedora Local Security Checks	medium
64411	Fedora 18 : couchdb-1.2.1-2.fc18 (2013-1375)	Nessus	Fedora Local Security Checks	medium
63642	Apache CouchDB < 1.0.4 / 1.1.2 / 1.2.1 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2012-5650

medium

Tenable Plugins

medium

medium

low

medium

medium

medium

medium