Avvisi di Couchbase

Certain rare crashes might cause the private key of the generated certificate to be leaked to the log files.

When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. Workaround: Replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration.

Unauthenticated users can make a REST API call to the cluster manager. Each http request that has not been seen before by the cluster manager leads to a creation of a new metric. Each new metric takes some memory and some disk space, which can create a memory leak and disk space leak. If enough resources are used, it could cause a Couchbase Server node to fail.

The Index Service runs several network processes, Queryport, Dataport and Adminport. These are used to communicate with other Couchbase services. These processes take part in node to node communication, but do not communicate directly with SDK applications. In the affected versions of Couchbase Server, these network processes do not enforce authentication, so will process requests sent by unauthenticated users. Queryport server can respond to an unauthenticated user with index scan results. Dataport server can allow unauthenticated user to modify indexed data. Adminport server can allow unauthenticated user to perform DDL operations (like Create and Drop index). Possible workaround: As these ports are used only for internal communication by Couchbase Server, any connections/communication with non-Couchbase Server nodes and processes can be disabled at the network layer.

Diagnostic endpoints such as diag/eval are restricted and can only be executed from the loopback network. However, the checks put in place to address CVE-2018-15728 do not correctly check if a “X-Forwarded-For” header contains a loopback address. This header can be manipulated to workaround the loopback restriction. The vulnerability is limited to requests originating from private network and shared address spaces, per RFC6890. To be able to successfully issue requests to these endpoints a user requires full administrative privileges, regardless of “X-Forwarded-For” header used. A workaround for this issue is to firewall requests to the Couchbase Server nodes that contain “X-Forwarded-For” headers in environments where they are not required. Recognition: Mucahit Karadag / PRODAFT

While performing cluster node additions, a crash of the Cluster Manager (ns_server) may lead to the private key getting leaked into the log files. Someone who has access to the log files may be able to decrypt secure network connections to the cluster. If TLS is used the credentials of users and applications that login into the cluster may be acquired.