Executive brief
CouchAuth is an authentication library for APIs and applications that use CouchDB. A server-side template injection flaw in the email confirmation feature allows attackers to run limited commands or leak sensitive server information by crafting a malicious host header, potentially compromising server integrity and exposing confidential data.
Technical details
The vulnerability is a server-side template injection (SSTI) triggered via host header injection in the email change confirmation request flow. The root cause lies in improper sanitization of the host header before it is used in email template rendering. An attacker can send a specially crafted host header without authentication to trigger template injection during email processing. The attack requires network access to the email functionality endpoint but no user interaction or authentication. Successful exploitation allows an attacker to execute limited commands or leak server-side information. Affected versions are CouchAuth up to and including 0.21.2; patched versions may be available in the repository.
Affected products
- perfood couch-auth up to 0.21.2
Timeline
- 2025-02-10: disclosed
- 2025-02-10: advisory: GHSA-r385-c5fc-x56c published