CVE-2022-24706: Apache CouchDB Auth Bypass Vulnerability

CVE-2022-24706 Overview

CVE-2022-24706 is a critical authentication bypass vulnerability affecting Apache CouchDB versions prior to 3.2.2. The vulnerability allows remote attackers to access an improperly secured default installation without authentication and gain administrative privileges. This flaw stems from insecure default configuration settings that, when exploited, can lead to complete system compromise through remote code execution.

Apache CouchDB is a popular open-source NoSQL document-oriented database that uses JSON for documents and JavaScript for MapReduce indexes. The vulnerability is particularly dangerous because it affects default installations that have not been hardened according to Apache's security recommendations, and many deployments may be exposed on the network without proper firewall protection.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Attackers can gain full administrative access to CouchDB instances and execute arbitrary code on the underlying system.

Affected Products

• Apache CouchDB versions prior to 3.2.2
• Apache CouchDB default installations without proper security hardening
• CouchDB deployments exposed without firewall protection

Discovery Timeline

• April 26, 2022 - CVE-2022-24706 published to NVD
• October 28, 2025 - Last updated in NVD database

Technical Details for CVE-2022-24706

Vulnerability Analysis

This vulnerability exploits insecure default configuration in Apache CouchDB installations, specifically related to the Erlang distribution protocol used for cluster communication. CouchDB is built on Erlang/OTP, which uses a cookie-based authentication mechanism for inter-node communication. In default configurations, this Erlang cookie can be predictable or easily guessable, allowing attackers to establish unauthorized connections to the CouchDB node.

Once an attacker successfully authenticates to the Erlang distribution port (typically port 4369 for EPMD and dynamically assigned ports for node communication), they can execute arbitrary Erlang code on the target system. This effectively grants full administrative privileges to the CouchDB instance and enables remote code execution on the underlying operating system.

The vulnerability is classified under CWE-1188 (Initialization with Hard-Coded Network Resource Configuration Default), reflecting the core issue of insecure default settings that expose the system to attack.

Root Cause

The root cause of CVE-2022-24706 lies in CouchDB's default configuration that does not adequately secure the Erlang distribution mechanism used for clustering. By default, CouchDB installations may use a predictable Erlang cookie value, and the Erlang Port Mapper Daemon (EPMD) may be accessible from the network. When these conditions are present, attackers can connect to the Erlang runtime and execute arbitrary code.

While the CouchDB documentation has always recommended proper security hardening including firewall deployment, many installations in the wild do not follow these best practices, leaving the Erlang distribution ports exposed and vulnerable.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker targeting a vulnerable CouchDB instance would:

1. Identify exposed CouchDB instances with accessible Erlang distribution ports
2. Connect to the EPMD service (port 4369) to discover the CouchDB node name and distribution port
3. Authenticate to the Erlang distribution using the default or predictable cookie value
4. Execute arbitrary Erlang code through the established connection, which can spawn OS-level commands

The exploitation of this vulnerability has been documented in public exploit code available through Packet Storm Security, demonstrating both Apache CouchDB 3.2.1 Remote Code Execution and Apache CouchDB Erlang Remote Code Execution techniques. A detailed technical analysis is also available in this Medium article on CouchDB Erlang Cookie RCE.

Detection Methods for CVE-2022-24706

Indicators of Compromise

• Unexpected connections to Erlang distribution ports (typically 4369 and dynamically assigned high ports)
• Unauthorized administrative actions in CouchDB logs
• Anomalous process spawning from the CouchDB or Erlang beam process
• Network traffic patterns indicating Erlang distribution protocol communication from external sources

Detection Strategies

• Monitor for connection attempts to port 4369 (EPMD) from external or untrusted networks
• Implement network-based detection rules for Erlang distribution protocol handshakes
• Review CouchDB audit logs for unauthorized database operations or configuration changes
• Deploy endpoint detection to identify suspicious process trees originating from the CouchDB service

Monitoring Recommendations

• Configure alerting for any external access attempts to EPMD and Erlang distribution ports
• Implement log aggregation for CouchDB instances to centrally monitor administrative actions
• Use network segmentation monitoring to detect lateral movement following potential compromise
• Enable process execution monitoring on CouchDB servers to detect post-exploitation activity

How to Mitigate CVE-2022-24706

Immediate Actions Required

• Upgrade Apache CouchDB to version 3.2.2 or later immediately
• Implement firewall rules to block external access to ports 4369 and Erlang distribution ports
• Change the default Erlang cookie to a strong, random value
• Review CouchDB instances for signs of prior compromise before patching

Patch Information

Apache has addressed this vulnerability in CouchDB version 3.2.2. Organizations should upgrade to this version or later as soon as possible. The official Apache Mailing List Thread provides additional context on the security fix.

Given that this vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, federal agencies and organizations following CISA guidance are required to remediate this vulnerability according to specified timelines. The CouchDB Cluster Documentation provides guidance on secure cluster configuration.

Workarounds

• Configure firewall rules to restrict access to CouchDB administrative ports to trusted networks only
• Bind CouchDB and Erlang services to localhost or internal interfaces if remote access is not required
• Generate and configure a strong, unique Erlang cookie for each CouchDB deployment
• Implement network segmentation to isolate CouchDB instances from untrusted network segments

# Firewall configuration example to restrict Erlang ports
# Block external access to EPMD and Erlang distribution ports
iptables -A INPUT -p tcp --dport 4369 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 4369 -j DROP
iptables -A INPUT -p tcp --dport 9100:9200 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 9100:9200 -j DROP