DEV Community

kozhevniko
kozhevniko

Posted on

CouchDB in external measurements: 983,358 fingerprint matches and 227 title matches

#database #couchdb #fingerprintcoverage

CouchDB in external measurements: 983,358 fingerprint matches and 227 title matches

A database with an HTTP API

CouchDB is a document database whose primary interface is HTTP. Every database is an endpoint, replication is a configuration decision, and the administrative interface is the same surface. That design makes exposure measurement unusually meaningful, because reaching the service and reaching the data are the same action.
It also makes the measurement unusually confusing, because the two available queries disagree by more than three orders of magnitude.

What was queried

Three queries against ZoomEye on 2026-09-26 (UTC), Python SDK, sub_type=all, page size one:

  • app="CouchDB": 983,358
  • title="CouchDB": 227
  • port=5984: 1,249,209

A very large fingerprint and a very small title count

The fingerprint returns close to a million matches while the title query returns 227. The API-oriented design explains the direction of the difference: a CouchDB endpoint answering an API request may return a JSON document with no HTML title at all, so a title query measures only the minority of deployments that serve a web interface with a recognisable heading.
The fingerprint, conversely, recognises the service behaviour. It is a much larger estimate, and it is the estimate that corresponds to the design of the product.
The port query returns 1.25 million, which is close to the fingerprint figure by coincidence rather than by relationship; it describes every service on 5984. Using it interchangeably with the CouchDB estimate would be a category error, even though the numbers are similar.

Operational focus

  1. The administrative interface. CouchDB's administrative endpoints are HTTP endpoints, and the vendor documentation describes the authentication model and the recommended configuration for them. An instance reachable without authentication is a complete exposure of every database it serves.
  2. Replication configuration. Replication to a remote target is a feature that, in a permissive configuration, allows data to be pulled to a system the operator does not control. The configuration reference describes the settings involved, and they deserve review rather than defaults.
  3. Version questions. The product has a documented history of issues in its HTTP interface, and the relevant question for any measured instance is again the version in use, which these counts do not provide.

Limitations

The two product queries measure different things and neither proves that an instance is unauthenticated, misconfigured, or vulnerable. The title count should not be used to size this population, and the fingerprint should not be read as a vulnerability count.

References

Top comments (0)