Unfortunately, the getter function for CouchDB’s internal representation of the data will only return the And so, we can bypass all of the relevant input validation and create an admin user thusly:Now that we have an administrator account, we have complete control of the database. The ability to inject malware into upstream project dependencies is a scary attack vector, and one from which I doubt most organizations are adequately protected.With this in mind, I started searching for bugs in registry.npmjs.org, the server responsible for distributing npm packages. If you have to, perhaps because your project uses multiple languages like in CouchDB, do your best to ensure that there aren’t any functional differences between the parsers like there were here. The basic idea is that it’s a “NoSQL” database that makes data replication very easy. Getting a shell from here is usually easy since CouchDB lets you define custom I’ve been trying to figure out exactly how npm was affected by this bug.
Since I didn’t actually exploit the vulnerability against any of npm’s production servers, I have to make educated guesses about which parts of the infrastructure were vulnerable to which parts of the attack, based on publicly available information.It’s probably a bad idea to use more than one parser to process the same data.
It’s sort of like a big key-value store for JSON blobs (“documents”), with features for data validation, querying, and user authentication, making it closer to a full-fledged database. Last time, I wrote about a deserialization bug leading to With this in mind, I started searching for bugs in The npm registry uses CouchDB, which I hadn’t heard of before this project. These scripts are automatically evaluated when a document is created or updated.
They start in a new process, and are passed JSON-serialized documents from the Erlang side.CouchDB manages user accounts through a special database called The problem is that there is a discrepancy between the Javascript JSON parser (used in validation scripts) and the one used internally by CouchDB, called For a given key, the Erlang parser will store both values, but the Javascript parser will only store the last one.
Stay tuned and find out! tl;dr There was a vulnerability in CouchDB caused by a discrepancy between the database’s native JSON parser and the Javascript JSON parser used during document validation. Because CouchDB databases are meant to be exposed directly to the internet, this enabled privilege escalation, and ultimately remote code execution, on a large number of installations. CouchDB is written in Erlang, but allows users to specify document validation scripts in Javascript.
It’s unfortunate that the JSON standard Thanks to the CouchDB team for having a published security@ email address and working quickly to get this fixed.If you’re interested in ditching #birdsite and want to use a social network that actually respects your freedoms, you should consider Will I abandon this blog after only a few posts?