CVE-2021-21311

Executive Summary

CVE-2021-21311 is a server-side request forgery (SSRF) vulnerability affecting Adminer, an open-source database management tool distributed as a single PHP file. Versions from 4.0.0 through before 4.7.9 are vulnerable when the bundled-all-drivers variant (adminer.php) is used. Successful exploitation allows an attacker to make crafted requests from the server hosting Adminer, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the public internet. The vulnerability has a CVSS score of 7.2, is listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and has a very high EPSS score (0.90461, 99.8th percentile), indicating active exploitation in the wild.

Technical Analysis

Adminer is a lightweight, single-file database management application written in PHP. It supports multiple database drivers (MySQL, PostgreSQL, SQLite, MSSQL, etc.) and is commonly deployed for quick database administration tasks. The application is frequently exposed to the internet either as a dedicated endpoint or embedded within larger web applications.

The vulnerability exists in Adminer versions 4.0.0 through 4.7.8, specifically in the build that bundles all database drivers (e.g., adminer.php). The root cause is insufficient validation of server-side requests, allowing an attacker to coerce the Adminer application into making HTTP requests to arbitrary destinations. This is a classic SSRF flaw: the vulnerable code path accepts attacker-controlled input that dictates the target of a server-initiated request without adequate restriction on scheme, host, or port.

The NVD description does not disclose the exact vulnerable parameter or function name; however, the attack mechanism is understood from the vulnerability class. Adminer's functionality inherently requires the server to connect to database servers, making it a natural candidate for SSRF abuse. The attacker abuses this by providing database connection parameters (hostname/IP, port, and possibly protocol) that point not to a legitimate database, but to arbitrary internal services. When Adminer initiates a connection to the supplied endpoint, it effectively performs a request on behalf of the attacker from the server's network position.

Notably, the CNA title explicitly labels the issue as "SSRF in adminer," confirming the vulnerability class. The lack of published technical details on the specific affected code path limits the ability to provide a line-level analysis; however, the SSRF class is well-understood and the fix (version 4.7.9) addresses the request validation gap. Users of builds that bundle all drivers are specifically affected because this configuration exposes the connection parameter handling to attacker influence.

The attack surface is significant because Adminer often runs with elevated database credentials and is frequently deployed on internal networks or within cloud environments. The combination of public exposure and server-side request capability makes this vulnerability particularly attractive to attackers attempting to pivot from an externally reachable web endpoint into internal infrastructure.

Exploitation Scenarios

No public exploit code or PoC is documented in the provided intelligence data beyond the presence of a Nuclei template referenced as unavailable. The attack chain below is inferred from the SSRF vulnerability class and the software's functional behavior.

1. Reconnaissance/Target Identification: Attackers scan for exposed Adminer instances using search engine dorking (e.g., intitle:"Login - Adminer") or mass port scans for endpoints such as /adminer.php, /adminer, or /dbadmin. The Shodan dorks provided in the metadata section are commonly used to identify these installations. Once a target is found, the attacker verifies the version (visible in the page footer or via specific behavior differences) to confirm it falls within the vulnerable range (4.0.0 to 4.7.8).

2. Triggering the SSRF: The attacker interacts with the Adminer login form, which accepts database server connection parameters (host, port, username, password, and driver type). Instead of supplying a legitimate database hostname, the attacker supplies an internal IP address, hostname, or cloud metadata IP (e.g., 169.254.169.254 on AWS/GCP/Azure) as the database server address. The attacker may also manipulate the driver selection or protocol parameter if the bundled-all-drivers build permits more exotic connection schemes.

3. Payload Execution/Request Exfiltration: When Adminer processes the login attempt, it attempts to establish a connection to the supplied host and port. This connection attempt, from the server's network position, constitutes the SSRF. Depending on the driver and the error handling, the attacker may observe connection timing differences, error messages revealing banner information, or the actual response data (e.g., if the target service returns data that Adminer displays as a database error or query result). With the PostgreSQL or MySQL drivers, for example, the attacker can probe arbitrary ports and read banners. In more advanced scenarios, if the vulnerable code path allows URL-based connection strings, the attacker can supply a full URL (e.g., http://169.254.169.254/latest/meta-data/) and potentially retrieve the response content within error messages displayed back to the client.

4. Post-Exploitation Impact: Once the attacker confirms SSRF capability, they can:

   • Access cloud metadata endpoints to retrieve IAM credentials, instance identity documents, and other sensitive configuration data.
   • Probe internal network services (SSH, Redis, internal web apps) to map the internal network topology and identify further attack targets.
   • Read internal web application responses if the SSRF allows full HTTP response retrieval, enabling access to internal administrative interfaces and sensitive data.
   • Chain with other vulnerabilities to achieve remote code execution or lateral movement within the internal network.

The severity of post-exploitation is amplified by the fact that Adminer often runs with high privileges and is placed on servers with outbound network access to internal resources.

Impact Assessment

Business Impact: Successful exploitation of CVE-2021-21311 can lead to unauthorized access to internal network resources, exfiltration of sensitive data (including cloud provider credentials), and potential lateral movement within the organization's infrastructure. The SSRF allows an attacker to bypass perimeter security controls, effectively turning a public-facing web application into a proxy for internal reconnaissance and attacks.

Affected Systems: All Adminer installations running versions 4.0.0 through 4.7.8 that bundle all database drivers. This includes adminer.php single-file deployments and any packaging that includes the full driver set. Standalone driver-specific builds may not be affected, per the NVD description wording ("Users of Adminer versions bundling all drivers are affected").

Blast Radius: The vulnerability has a CVSS score of 7.2 with the vector approximated as AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N (Network attack vector, Low complexity, No privileges, No user interaction, Changed scope, High confidentiality impact). The "Changed scope" component indicates that the vulnerable component is different from the impacted resource—the SSRF allows compromise of resources beyond the Adminer application itself, including the internal network and cloud environment. This significantly expands the blast radius: a single exposed Adminer instance can expose the entire internal network to the attacker.

Real-World Exploitation: The CISA KEV catalog lists this vulnerability as actively exploited, and the EPSS score of 0.90461 (99.8th percentile) confirms that it is among the most likely CVEs to be exploited. This is consistent with the pattern of internet-exposed database management tools being prime targets for automated scanning campaigns and botnets.

Detection Guidance

Detection of SSRF exploitation attempts against Adminer requires visibility into both network traffic (inbound to the Adminer endpoint and outbound from the server) and application logs.

Sigma Rule

title: Adminer SSRF Exploitation Attempt (CVE-2021-21311)
id: 7f3a2c8e-1b45-4f67-9a2d-5e8c1a3b6f42
status: experimental
description: Detects HTTP requests to Adminer login endpoint with suspicious database host parameters indicating potential SSRF exploitation
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21311
author: Valtersit Threat Intelligence
date: 2024/11/10
tags:
    - attack.t1190
    - cve.2021.21311
logsource:
    category: webserver
    product: generic
detection:
    selection_adminer:
        cs-method: 'POST'
        c-uri|contains:
            - 'adminer.php'
            - '/adminer/'
            - '/dbadmin'
    selection_suspicious_host:
        c-uri|contains:
            - 'server=169.254.169.254'   # cloud metadata IP
            - 'server=metadata.google.internal'
            - 'server=10.'
            - 'server=172.16.'
            - 'server=192.168.'
            - 'server=localhost'
            - 'server=127.0.0.1'
            - 'username='                  # login attempt present
    selection_scan_pattern:
        c-uri|contains:
            - '127.0.0.1'
            - '0.0.0.0'
    condition: selection_adminer and (selection_suspicious_host or selection_scan_pattern)
    level: high

YARA Rule

rule Adminer_SSRF_CVE_2021_21311
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Adminer PHP source code patterns vulnerable to CVE-2021-21311 SSRF"
        cve = "CVE-2021-21311"
        date = "2024-11-10"
        severity = "high"
    strings:
        $adminer_marker = "Adminer" ascii
        $version_pattern = /Adminer 4\.[0-7]\.[0-8]/ ascii
        $server_param = "server" ascii
        $db_driver_connect = "connect(" ascii
        $curl_usage = "curl_" ascii
        $socket_usage = "socket" ascii
        $host_param = "host" ascii
    condition:
        uint16(0) == 0x3C3F and   // "<?"
        $adminer_marker and
        ($version_pattern or (filesize < 2000000))
        and $server_param
        and ($db_driver_connect or $curl_usage or $socket_usage)
        and $host_param
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Adminer SSRF Attempt (CVE-2021-21311)";
    flow:established,to_server;
    content:"POST";
    http_method;
    content:"adminer.php";
    http_uri;
    pcre:"/(server|host)=((169\.254\.169\.254)|(127\.0\.0\.1)|(localhost)|(10\.[0-9]+\.)|(172\.(1[6-9]|2[0-9]|3[01])\.)|(192\.168\.))/i";
    classtype:attempted-admin;
    sid:202111301;
    rev:1;
    metadata:cve CVE-2021-21311, reference https://nvd.nist.gov/vuln/detail/CVE-2021-21311;
)

alert http $HOME_NET any -> any any (
    msg:"ET OBSERVED Adminer Outbound Connection to Internal IP (Potential SSRF CVE-2021-21311)";
    flow:established,to_server;
    content:"Host:";
    http_header;
    pcre:"/^(10\.|127\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/";
    classtype:attempted-recon;
    sid:202111302;
    rev:1;
    metadata:cve CVE-2021-21311, reference https://nvd.nist.gov/vuln/detail/CVE-2021-21311;
)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [network where destination.ip == "169.254.169.254" and process.name == "php"] // cloud metadata
  [network where destination.port == 80 and destination.ip == "169.254.169.254"]

// Detection of HTTP requests to Adminer with internal IPs as DB server parameters
any where event.category == "web" and url.path like "*adminer*" and url.query like "*server=10.*"
  and (url.query like "*server=10.*" or url.query like "*server=192.168.*" 
       or url.query like "*server=172.16.*" or url.query like "*server=127.0.0.1*"
       or url.query like "*server=169.254.*" or url.query like "*server=localhost*")

Splunk SPL Query

index=web sourcetype="access_combined" OR sourcetype="apache_access" 
    (uri_path="*adminer.php*" OR uri_path="/adminer/*" OR uri_path="/dbadmin*")
    (uri_query="*server=10.*" OR uri_query="*server=172.16.*" OR uri_query="*server=192.168.*" 
     OR uri_query="*server=127.0.0.1*" OR uri_query="*server=localhost*" 
     OR uri_query="*server=169.254.*" OR uri_query="*server=metadata*")
| stats count by src_ip, dest_ip, uri, status, useragent
| sort -count
| table _time, src_ip, dest_ip, uri, status, count

// Detection of outbound connections from web server to internal IPs
index=network sourcetype=conn 
    dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1", "169.254.169.254")
    process="php*"
| stats count by src_ip, dest_ip, dest_port, process_name
| where count > 5

Wazuh OSSEC Rule

<group name="web,">
  <rule id="202113" level="12">
    <decoded as="json">json</decoded>
    <field name="url">\.adminer\.php|/adminer/|/dbadmin</field>
    <field name="data">server=(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.0\.0\.1|localhost|169\.254\.|metadata)</field>
    <description>Possible Adminer SSRF exploitation attempt (CVE-2021-21311)</description>
    <group>ssrf,exploit,web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="202114" level="10">
    <decoded as="json">json</decoded>
    <field name="url">\.adminer\.php|/adminer/|/dbadmin</field>
    <field name="method">POST</field>
    <field name="data">server=</field>
    <description>Adminer login attempt with server parameter (potential SSRF)</description>
    <group>ssrf,web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — The CNA (who assigned CVE-2021-21311) and Debian both confirm the fix in version 4.7.9. This is a reliable indication that upgrading resolves the vulnerability.

Immediate Mitigations

1. Restrict network access: Limit access to the Adminer endpoint to trusted IPs only using firewall rules or web server ACLs. If Adminer is not required to be publicly accessible, place it behind VPN or an internal-only network segment.
2. Disable the bundled-all-drivers variant: If a driver-specific build can replace the full adminer.php, switch to a minimal build containing only the required database driver, as the NVD description indicates only the bundled-all-drivers version is affected.
3. Harden outbound connectivity: Configure egress firewall rules on the server hosting Adminer to block outbound connections to internal RFC-1918 addresses and to the cloud metadata IP (169.254.169.254). This limits the impact even if SSRF is exploited.
4. Monitor and alert: Apply the detection rules provided in this report to existing SIEM/IDS infrastructure to identify active exploitation attempts.

Patch/Upgrade Steps

1. Upgrade Adminer: Update to version 4.7.9 or later immediately. The official Adminer distribution pages provide updated single-file downloads.
2. Verify deployment packaging: Check all servers, containers, and embedded applications for Adminer files and ensure the updated version is deployed uniformly.
3. Apply OS package updates: For distributions like Debian that package Adminer, apply the security update via the package manager (e.g., apt update && apt upgrade adminer).

Long-Term Hardening

1. Reduce attack surface: Remove Adminer from production environments entirely. Database administration should be performed from controlled internal networks via bastion hosts, not from internet-exposed web applications.
2. Implement robust input validation: For any web application that accepts host/URL parameters, enforce allowlists for permitted destinations and schemes at the application layer.
3. Network segmentation: Place database management tools and interfaces outside the corporate network perimeter or in isolated security zones with strict egress controls.
4. Vulnerability management: Prioritize patching of internet-exposed applications, particularly those listed in CISA's KEV catalog, which indicates known active exploitation.
5. Regular security reviews: Audit web-facing applications for SSRF and other vulnerability classes, especially those that have inherent server-side request functionality.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-21311
2. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (search CVE-2021-21311)
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2021-21311
4. Adminer Official Site: https://www.adminer.org/ (contains version history and download links for patched releases)
5. MITRE ATT&CK T1190 - Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity: While the CISA KEV listing confirms that CVE-2021-21311 is actively exploited in the wild, the specific threat actor groups or campaigns remain undocumented in the provided data. The high EPSS percentile (99.8%) indicates widespread scanning and exploitation activity, consistent with automated botnets and opportunistic attackers targeting internet-exposed database management interfaces. Organizations should assume active exploitation attempts against exposed Adminer instances and prioritize immediate patching and detection implementation.