Executive brief
PouchDB is a database library used to store and synchronize data in web and mobile applications. Affected versions fail to properly isolate the execution environment for map/reduce functions, allowing an attacker to execute arbitrary code on the server under certain conditions. This could lead to complete system compromise, data theft, or malware installation.
Technical details
The vulnerability is a code injection flaw (CWE-94) in PouchDB's map/reduce function sandbox. The product does not properly isolate the code execution engine that runs map/reduce functions for temporary views and design documents, allowing an attacker to break out of the sandbox and execute arbitrary code. The attack requires the ability to supply malicious map/reduce functions, which may be possible through design document uploads or certain API endpoints depending on deployment context. All versions before 6.0.5 are affected; the patch is available in version 6.0.5 and later.
Affected products
- PouchDB PouchDB < 6.0.5
Timeline
- 2018-07-26: disclosed
- 2016: patched: Fix available in version 6.0.5