ZDI-CAN-28201: Adminer ReDoS Bypass Leads to RCE

Vulnerability Overview ZDI-CAN-28201: multi_query Incorrect Check of Function Return Value RCE Description: This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in Adminer. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files via SQLi ATTACH statements, achieving Remote Code Execution (RCE). The patch introduced a regex filter to block ATTACH queries, but this filter is susceptible to catastrophic backtracking. CVSS Score: 7.2 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Affected Versions Affected Version: 5.4.2 Fixed Version: 5.4.3 Platform: Debian Installation File: adminer-5.4.2.php Remediation Fixed Version: 5.4.3 Analysis Vulnerability Principle: This vulnerability exploits the behavior of PHP’s function, which returns when the backtrack limit is exceeded. The code only checks for truthiness (where indicates a match), treating as (no match). This allows the ATTACH statement to bypass the security filter. Key Code: An attacker uploads a malicious SQL file, the contents of which are read into the variable without any initial sanitization. A regex pattern is defined for the ATTACH filter. The greedy quantifier combined with the SQL comment pattern leads to catastrophic backtracking when processing comment lines. The ATTACH query filter check. When the regular expression encounters 350,000 SQL comment lines, catastrophic backtracking is triggered. The greedy quantifier causes exponential backtracking, eventually hitting PHP's backtrack limit, causing to return instead of or , thereby bypassing the security filter. When the ATTACH filter is bypassed because returns , the malicious SQL query containing the ATTACH statement is executed. This allows the attacker to create a PHP file with embedded PHP code, achieving Remote Code Execution when the file is accessed via HTTP. Proof of Concept ZDI-CAN-28201.zip contains the complete Proof of Concept (PoC) environment, including: - folder: Complete Adminer setup with necessary plugins and configurations - : The vulnerable Adminer application (version 5.4.2) - : PHP configuration file with SQLi extensions enabled - : Directory containing the plugin - : Plugin configuration file containing password hashes (password is 'password123') - : Exploit generation script Setup Instructions 1. Place the provided folder on a Debian machine. 2. Configure the SQLite password settings as shown in (password: 'password123'). 3. Run the following command from inside the folder: 4. Generate the file using : Exploitation Steps 1. Navigate to 2. Select SQLite as the database system 3. Enter the password 'password123' (configured in ) 4. Click on the "Import" section in the left sidebar 5. Upload the generated file 6. Click "Execute" 7. Upon success, the system displays "3 queries executed OK" 8. A file named containing PHP code is created in the directory 9. Access to execute the embedded PHP code Exploit Principle The exploit works by generating approximately 350,000 SQL comment lines ( ) followed by a malicious ATTACH statement. The excessive number of comment lines causes the regular expression to exceed PHP's backtrack limit, forcing to return instead of or . This bypasses the ATTACH filter and allows the execution of the malicious SQL. Additional Information Discoverer: Discovered in collaboration with Odysseus (Sorcery Ltd) and Trend Micro Zero Day Initiative Support Files: If support files are included in the report, they will be provided in a password-protected ZIP file. The password is the ZDI candidate number, formatted as: ZDI-CAN-XXXX, where XXXX is the ZDI ID number. Disclosure Policy: Our vulnerability disclosure policy can be viewed online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/

Goal Reached Thanks to every supporter — we hit 100%!

ZDI-CAN-28201: Adminer ReDoS Bypass Leads to RCE

More from this source