CVE-2023-45875
📋 TL;DR
CVE-2023-45875 is a private key leak vulnerability in Couchbase Server 7.2.0 where sensitive cryptographic keys are exposed in debug.log files when adding pre-7.0 nodes to a 7.2 cluster. This affects organizations running Couchbase Server 7.2.0 in mixed-version cluster configurations. Attackers who gain access to debug logs could potentially compromise cluster security.
💻 Affected Systems
- Couchbase Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain private keys from debug logs, enabling them to impersonate nodes, decrypt sensitive data, or gain unauthorized access to the entire Couchbase cluster.
Likely Case
Unauthorized users with access to debug logs extract private keys, potentially compromising specific nodes or exposing sensitive cluster communications.
If Mitigated
With proper log access controls and monitoring, the impact is limited to potential information disclosure without direct system compromise.
🎯 Exploit Status
Exploitation requires access to debug.log files, which typically requires some level of system access. The vulnerability is straightforward to exploit once log access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.2.1 or later
Vendor Advisory: https://docs.couchbase.com/server/current/release-notes/relnotes.html
Restart Required: Yes
Instructions:
1. Upgrade Couchbase Server to version 7.2.1 or later. 2. Restart all Couchbase services. 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Restrict debug.log access
linuxSet strict file permissions on debug.log files to prevent unauthorized access
chmod 600 /opt/couchbase/var/lib/couchbase/logs/debug.log
chown couchbase:couchbase /opt/couchbase/var/lib/couchbase/logs/debug.log
Disable debug logging
allTemporarily disable debug logging during node addition operations
cbcollect_info --disable-debug
🧯 If You Can't Patch
- Avoid adding pre-7.0 nodes to 7.2.0 clusters
- Implement strict access controls on log directories and files
🔍 How to Verify
Check if Vulnerable:
Check if running Couchbase Server 7.2.0 and examine cluster configuration for mixed-version nodesCheck Version:
couchbase-server --versionVerify Fix Applied:
Verify Couchbase Server version is 7.2.1 or later and check debug.log for private key exposure📡 Detection & Monitoring
Log Indicators:
- Private key strings appearing in debug.log
- Sensitive cryptographic material in log files
Network Indicators:
- Unauthorized access attempts to log directories
SIEM Query:
source="couchbase.logs" AND "private key" AND "debug.log"