CouchDB

Apache CouchDB is a document-oriented NoSQL database that uses JSON for documents and exposes a RESTful HTTP API. It listens on TCP port 5984 by default. Nmap identifies it as couchdb or http on this port.

CouchDB has been involved in numerous data exposure incidents due to permissive default configurations. The "Admin Party" mode in older versions grants full admin access to anyone without authentication. Even on newer versions, misconfigured installations allow unauthenticated database listing and data access. CouchDB's built-in replication feature can be abused to exfiltrate entire databases to an attacker-controlled server. CVE-2017-12635 and CVE-2017-12636 demonstrated privilege escalation and remote code execution through the REST API.

Enumeration begins with requesting the root endpoint (/) for version information, then /_all_dbs to list all databases. Each database can be queried with /_all_docs to retrieve every document. The /_config or /_node/_local/_config endpoint (depending on version) may expose server configuration including credentials. Checking for admin access and the ability to create design documents with JavaScript view functions can lead to server-side code execution.