Description
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe internal database hosts, or to /connections/save to overwrite stored connections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dbgate | dbgate | < 7.3.3 | 7.3.3 |
References
- GitHub Issue #1601 issue-tracking
- https://github.com/dbgate/dbgate product
- Fix commit patch
- https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L227-L250 technical-description
- https://github.com/dbgate/dbgate/blob/v7.3.2/packages/api/src/controllers/connections.js#L372-L390 technical-description
- VulnCheck Advisory: DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save third-party-advisory