Adminer CSP Bypass via Malicious MySQL Version String

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Adminer versions 5.4.2 and earlier. It occurs when Adminer inserts an unsanitized MySQL server version string into a script tag with a valid Content Security Policy (CSP) nonce. Attackers controlling a malicious MySQL server can craft a version string that breaks out of the JavaScript context, executing arbitrary code. The browser's CSP does not block execution because the script tag has a valid nonce.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Adminer versions 5.4.2 or earlier are installed on your system. Review the `adminer.inc.php` file for improper sanitization of MySQL version strings. Monitor network traffic for rogue MySQL servers attempting to inject crafted version strings.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in your browser when you access Adminer connected to a malicious MySQL server. This could lead to session hijacking, data theft, or unauthorized actions on your behalf. The attack requires network access and may involve tricking you into logging into the malicious server via Login CSRF.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. If exploited, it may result in data breaches, triggering compliance obligations such as breach notifications and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Adminer to version 5.4.3 or later immediately. Disable automatic login to untrusted MySQL servers. Implement strict input validation for version strings. Add additional CSP headers to block inline scripts if possible.

Useful 0 Not Useful 0