Description
pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
sosedoff pgweb
Default version status: unaffected
0 to ≤ 0.17.0affected
pkg:golang/github.com/sosedoff/pgwebReferences
- https://github.com/sosedoff/pgweb/issues/869 ↗
- https://github.com/sosedoff/pgweb ↗
- https://github.com/sosedoff/pgweb/blob/6b0b0244d1aefd6971999b03481eeeaa4ec7cf55/pkg/api/routes.go ↗
- https://github.com/sosedoff/pgweb/blob/6b0b0244d1aefd6971999b03481eeeaa4ec7cf55/pkg/api/api.go ↗
- https://www.vulncheck.com/advisories/pgweb-through-0.17.0-missing-authorization-on-direct-connect-endpoint ↗