# 2.6. CVE-2012-5650: DOM based Cross-Site Scripting via Futon UI

Date:

  14.01.2013

Affected:

  Apache CouchDB releases up to and including 1.0.3, 1.1.1, and 1.2.0 are vulnerable.

Severity:

  Moderate

Vendor:

  The Apache Software Foundation

## 2.6.1. Description

Query parameters passed into the browser-based test suite are not sanitised, and can be used to load external resources. An attacker may execute JavaScript code in the browser, using the context of the remote user.

## 2.6.2. Mitigation

Upgrade to a supported CouchDB release that includes this fix, such as:

- 1.0.4

- 1.1.2

- 1.2.1

- 1.3.x

All listed releases have included a specific fix.

## 2.6.3. Work-Around

Disable the Futon user interface completely, by adapting local.ini and restarting CouchDB:

    [httpd_global_handlers]
    _utils = {couch_httpd_misc_handlers, handle_welcome_req, <<"Forbidden">>}

Or by removing the UI test suite components:

- share/www/verify_install.html

- share/www/couch_tests.html

- share/www/custom_test.html

## 2.6.4. Acknowledgement

This vulnerability was discovered & reported to the Apache Software Foundation by Frederik Braun.