CVE-2021-29625

Executive Summary

CVE-2021-29625 is a reflected cross-site scripting (XSS) vulnerability in Adminer, an open-source database management tool, affecting versions 4.6.1 through 4.8.0. The vulnerability is triggered through the doc_link parameter and impacts deployments using MySQL, MariaDB, PgSQL, and SQLite when the application communicates with the database via a pdo_ extension (used when native PHP extensions are not enabled). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the logged-in administrator's browser session, potentially leading to session hijacking, credential theft, or unauthorized database manipulation. The vulnerability has a CVSS score of 7.5 and is patched in Adminer version 4.8.1.

Technical Analysis

The vulnerability is a cross-site scripting (XSS) flaw categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). The issue resides in Adminer's handling of the doc_link parameter, which is used to generate documentation hyperlinks within the application interface. Insufficient sanitization of this input allows an attacker to inject arbitrary HTML and JavaScript payloads.

The attack surface is the Adminer web interface itself, which is typically deployed as a single-file PHP application accessible via a web server. Adminer is frequently exposed directly to untrusted networks or the internet, making it a prime target for reconnaissance and exploitation.

The NVD description notes an important technical condition: in most modern browsers, a strict Content Security Policy (CSP) prevents the XSS from executing. However, when Adminer uses a pdo_ extension for database connectivity (which occurs when native extensions such as mysqli are not enabled), the application is unable to emit a strict CSP, leaving the vulnerability exploitable in browsers that do not enforce CSP by default. Additionally, if the server has display_errors enabled, this further weakens the browser-side protections.

From a code-level perspective, the flaw is consistent with an unescaped output of user-controllable data within a generated HTML document. The doc_link parameter is reflected in the response without proper encoding, allowing an attacker to craft a URL that, when visited by an authenticated administrator, executes malicious script in the admin's session context.

The vulnerability is patched in version 4.8.1, where the output is properly sanitized. Workarounds include using a browser that enforces strict CSP, enabling native PHP database extensions (e.g., mysqli), or disabling display_errors in the PHP configuration.

Exploitation Scenarios

Note: No public exploit code is available; the attack chain below is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance/Target Identification: An attacker scans for publicly exposed Adminer instances using Shodan or similar search engines with queries such as product:"Adminer" or http.title:"Adminer". Once a target is identified, the attacker verifies the version (e.g., via the login page footer or HTTP response headers) to confirm it falls within the affected range 4.6.1–4.8.0.

Step 2 — Triggering the Flaw: The attacker crafts a malicious URL containing an XSS payload in the doc_link parameter. Since the application reflects this parameter without sanitization, the payload will be included in the HTML response. The attacker must ensure the target environment meets the precondition for exploitation: Adminer is using a pdo_ extension (native DB extensions are disabled) and the browser does not enforce strict CSP.

Step 3 — Payload/Execution Method: The crafted URL is delivered to an authenticated Adminer administrator—via phishing email, instant messaging, or a link injected into a forum post. When the administrator clicks the link, the browser renders the malicious JavaScript payload within the Adminer application's origin. The script executes with the privileges of the logged-in admin session.

Step 4 — Post-Exploitation Impact: The injected JavaScript can perform any action the administrator is authorized to perform. Typical payloads may: steal session cookies and exfiltrate them to an attacker-controlled server; capture keystrokes (including database credentials entered in forms); forge requests to create new database users, drop tables, or alter data; or embed a persistent backdoor by modifying Adminer files (if file-write permissions exist). Given Adminer's privileged role as a database management console, a successful attack grants the adversary direct control over the underlying database(s).

Impact Assessment

CVSS Analysis: The vulnerability holds a CVSS score of 7.5 (High). Based on the described attack vector (network, low complexity, no privileges required, user interaction required), the impact is high on confidentiality and negligible on integrity and availability. This scoring reflects that the primary consequence is unauthorized data exposure and session compromise rather than direct data corruption or service disruption.

Business Impact: Organizations using Adminer as a database management front-end face significant risk. The tool is typically used by DBAs and developers with elevated database privileges. A compromise of an Adminer session can lead to exfiltration of sensitive data, unauthorized schema changes, or complete database takeover. Regulatory implications arise if the database contains personal data covered by GDPR, HIPAA, or PCI-DSS.

Blast Radius: The affected platforms include MySQL, MariaDB, PgSQL, and SQLite. The practical blast radius is narrowed by the requirement that native PHP database extensions must be disabled (forcing use of PDO). However, this is a common configuration on shared hosting and minimal PHP installations, making the threat realistic for a meaningful subset of Adminer deployments.

Data Sensitivity: Adminer manages database credentials and exposes schema information. Exploitation could expose connection strings, table structures, and data contents—highly sensitive information that could be used for further lateral movement within an enterprise network.

Detection Guidance

The following detection rules target the exploitation of CVE-2021-29625 by identifying anomalous request patterns containing XSS payloads in the doc_link parameter directed at Adminer endpoints.

Sigma Rule

title: Adminer CVE-2021-29625 XSS Attempt in doc_link Parameter
id: 1c3a2a7e-2f6b-4e0c-8a9d-7f35b2e1c4d8
status: experimental
description: Detects HTTP requests to Adminer endpoints containing XSS payloads in the doc_link parameter.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-29625
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2021-29625
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - 'doc_link='
        cs-uri-query|re:
            - '(<script|javascript:|onerror=|onload=|&#x|%3Cscript|%253Cscript)'
    condition: selection and not filter
    filter:
        cs-uri-query|contains:
            - 'adminer'
            - 'adminer.php'
            - 'index.php'
falsepositives:
    - Legitimate use of doc_link with URLs containing similar patterns (rare)
level: high

YARA Rule

rule Adminer_CVE_2021_29625_XSS_Payload
{
    meta:
        author = "Valters.it Threat Intel"
        description = "Detects XSS payloads targeting Adminer CVE-2021-29625 in the doc_link parameter"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-29625"
        date = "2024-01-15"
        cve = "CVE-2021-29625"
        severity = "high"

    strings:
        $doc_link = "doc_link=" ascii wide nocase
        $script_tag = "<script" ascii wide nocase
        $js_alert = "javascript:" ascii wide nocase
        $event_handler = "onerror=" ascii wide nocase
        $event_handler2 = "onload=" ascii wide nocase
        $encoded = "%3Cscript" ascii wide nocase
        $encoded_full = "%253Cscript" ascii wide nocase

    condition:
        $doc_link and any of ($script_tag, $js_alert, $event_handler, $event_handler2, $encoded, $encoded_full)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2021-29625 Adminer XSS Attempt in doc_link Parameter"; flow:established,to_server; content:"GET"; http_method; content:"doc_link="; http_uri; nocase; pcre:"/(<script|javascript:|onerror=|onload=|&#x|%3C|%253C)/i"; reference:cve,2021-29625; classtype:web-application-attack; sid:202129625; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where event.type == "start" and destination.port == 80 or destination.port == 443]
  [http where event.category == "web" and request.method == "GET"
   and url.query contains "doc_link=" 
   and (url.query matches "*<script*" 
     or url.query matches "*javascript:*" 
     or url.query matches "*onerror=*" 
     or url.query matches "*onload=*" 
     or url.query matches "*%3Cscript*" 
     or url.query matches "*%253Cscript*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where isnotnull(cs_uri_query)
  AND cs_uri_query LIKE "%doc_link=%"
  AND ( cs_uri_query LIKE "%<script%" 
        OR cs_uri_query LIKE "%javascript:%" 
        OR cs_uri_query LIKE "%onerror=%" 
        OR cs_uri_query LIKE "%onload=%" 
        OR cs_uri_query LIKE "%&#x%" 
        OR cs_uri_query LIKE "%3Cscript%" 
        OR cs_uri_query LIKE "%253Cscript%" )
| stats count by src_ip, cs_host, cs_uri_stem, http_user_agent
| sort - count

Wazuh OSSEC Rule

<group name="adminer,xss,">
    <rule id="100301" level="12">
        <decoded>web-accesslog</decoded>
        <match>doc_link=</match>
        <regex>(&lt;script|javascript:|onerror=|onload=|%3C|%253C)</regex>
        <description>Adminer CVE-2021-29625 XSS exploitation attempt detected in doc_link parameter</description>
        <group>attack.initial_access,attack.t1190,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (CNA and Debian) confirm the fix in version 4.8.1.

Immediate Mitigations

1. Restrict network access: Place Adminer behind a VPN or restrict access by source IP whitelist to trusted administrative networks.
2. Enable native PHP extensions: Enable mysqli or pgsql native extensions in PHP configuration so Adminer does not fall back to pdo_ drivers, which weakens CSP protection.
3. Disable display_errors: Set display_errors = Off in PHP configuration to reduce information leakage and harden the environment.
4. Enforce browser CSP: Instruct administrators to use modern browsers that enforce strict Content-Security-Policy headers.
5. Authentication hardening: Require strong passwords and enable multi-factor authentication if the deployment environment supports it.

Patch/Upgrade Steps

1. Upgrade Adminer: Download the latest version of Adminer (4.8.1 or later) from the official website (adminer.org) or the Debian package repository.
2. Verify version integrity: Confirm the SHA-256 checksum of the downloaded file against the official published hash.
3. Replace the adminer.php file: Overwrite the existing Adminer file(s) with the patched version and restart the web server or PHP-FPM service to ensure the update is picked up.
4. Run a smoke test: Log in via all supported database types (MySQL, MariaDB, PgSQL, SQLite) to confirm full functionality after upgrade.

Long-Term Hardening

1. Remove Adminer from production: Consider using Adminer only in staging/development environments. Use vendor-provided database management tools or enterprise-grade alternatives for production.
2. Web Application Firewall (WAF): Deploy a WAF with signatures for known Adminer CVEs and generic XSS payloads.
3. Regular vulnerability scanning: Include Adminer in your continuous vulnerability scanning lifecycle to detect outdated versions early.
4. Logging and monitoring: Enable access log collection for all Adminer endpoints and feed the logs into your SIEM for correlation with the detection rules above.
5. Principle of least privilege: Run Adminer with a database user that has limited privileges (e.g., no CREATE USER or DROP permissions) to reduce the impact of a session compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2021-29625
2. Adminer Official Website: https://www.adminer.org/
3. Debian Security Tracker (DSA/CVE reference): https://security-tracker.debian.org/tracker/CVE-2021-29625
4. CISA KEV Catalog: Not listed (CISA KEV: NO)
5. Exploit-DB / Nuclei: No public exploit code available; Nuclei template: NO

Threat Actor Activity: As of this report, no known threat actor campaigns or in-the-wild exploitation have been publicly documented for this specific CVE. However, Adminer has been targeted in prior campaigns (e.g., botnet scanning for exposed Adminer instances), and the EPSS score of 0.09572 (95th percentile) indicates a moderately high likelihood of exploitation in the wild. Monitoring for scanning activity targeting Adminer login pages is strongly advised.