# CouchDB

> CouchDB is a NoSQL database using HTTP API. Attackers enumerate exposed ports, probe admin interfaces, exploit misconfigs, escalate via Erlang cookie, and exfiltrate JSON documents

- **URL:** https://hackindex.io/services/couchdb
- **Type:** Service
- **Default ports:** 5984, 6984
- **Tags:** nosql, database, http, web, couchdb, linux
- **Published:** 2026-04-06
- **Updated:** 2026-09-14

Apache CouchDB is a document-oriented NoSQL database that uses JSON for documents and exposes a RESTful HTTP API. It listens on **TCP port 5984** by default. Nmap identifies it as `couchdb` or `http` on this port.

CouchDB has been involved in numerous data exposure incidents due to permissive default configurations. The "Admin Party" mode in older versions grants full admin access to anyone without authentication. Even on newer versions, misconfigured installations allow unauthenticated database listing and data access. CouchDB's built-in replication feature can be abused to exfiltrate entire databases to an attacker-controlled server. CVE-2017-12635 and CVE-2017-12636 demonstrated privilege escalation and remote code execution through the REST API.

Enumeration begins with requesting the root endpoint (`/`) for version information, then `/_all_dbs` to list all databases. Each database can be queried with `/_all_docs` to retrieve every document. The `/_config` or `/_node/_local/_config` endpoint (depending on version) may expose server configuration including credentials. Checking for admin access and the ability to create design documents with JavaScript view functions can lead to server-side code execution.

## Phases

- [Enumeration](https://hackindex.io/services/couchdb/enumeration.md): List DBs, dump docs, and extract hashes from _users (1 guides)
- [Exploitation](https://hackindex.io/services/couchdb/exploitation.md): Exploit CouchDB via admin party, CVE flaws, and Erlang RCE (1 guides)