QID 377922

Date Published: 2023-01-20

QID 377922: PgAdmin Server Remote Code Execution (RCE) Vulnerability

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.

Affected Products:
Prior to Version 6.17

QID Detection Logic (Authenticated):
The QID checks for the version information from the registry key

Successful exploitation could compromise confidentiality, integrity and security

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

phpPgAdmin Version 6.17 and above is not vulnerable. You can download the latest version from the phpPgAdmin page

Vendor References

release_notes_6_17 - www.pgadmin.org/docs/pgadmin4/6.17/release_notes_6_17.html

CVEs related to QID 377922

CVE-2022-4223 |

Software Advisories

Advisory ID	Software	Component	Link
pgadmin server 6.17			www.pgadmin.org/docs/pgadmin4/6.17/release_notes_6_17.html

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].