Junglewise Threat Intelligence

CVE-2024-57177: CouchAuth server-side template injection in email functionality

CVE-2024-57177 · Severity: low · CVSS 3.1 · Published 2025-02-10

Technologies: Perfood Couch-Auth, @perfood/couch-auth (npm). Vendors: Perfood, npm.

Executive brief

CouchAuth is an authentication library for APIs and applications that use CouchDB. A server-side template injection flaw in the email confirmation feature allows attackers to run limited commands or leak sensitive server information by crafting a malicious host header, potentially compromising server integrity and exposing confidential data.

Technical details

The vulnerability is a server-side template injection (SSTI) triggered via host header injection in the email change confirmation request flow. The root cause lies in improper sanitization of the host header before it is used in email template rendering. An attacker can send a specially crafted host header without authentication to trigger template injection during email processing. The attack requires network access to the email functionality endpoint but no user interaction or authentication. Successful exploitation allows an attacker to execute limited commands or leak server-side information. Affected versions are CouchAuth up to and including 0.21.2; patched versions may be available in the repository.

Affected products

  • perfood couch-auth up to 0.21.2

Timeline

  • 2025-02-10: disclosed
  • 2025-02-10: advisory: GHSA-r385-c5fc-x56c published

References

Related threats