Description
pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sosedoff | pgweb | ≤ 0.17.0 | — |
References
- GitHub Issue #869 issue-tracking
- https://github.com/sosedoff/pgweb product
- routes.go - /api/connect registered unconditionally alongside the backend-gated route technical-description
- api.go - Connect falls through to ConnectWithURL with no connect-backend check technical-description
- VulnCheck Advisory: pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint third-party-advisory