CVE-2023-45195

Executive Summary

CVE-2023-45195 is a Server-Side Request Forgery (SSRF) vulnerability in Adminer and AdminerEvo, a popular database management tool written in PHP. The vulnerability allows an unauthenticated remote attacker to exploit database connection fields to make the server issue arbitrary HTTP requests. This can be used to enumerate internal network services, access cloud metadata endpoints (e.g., AWS, GCP, Azure), or interact with other internal systems that the attacker would not otherwise have access to. The original Adminer project is no longer supported, but the issue was fixed in AdminerEvo version 4.8.4. The CVSS score is 0.0 in the NVD data, but based on the SSRF nature, a more realistic score is 8.6 (High) with a network-based, low-complexity attack vector.

Supply Chain & Package Security

AdminerEvo is distributed as a single PHP file and is also available via Composer (Packagist). Users who install AdminerEvo via Composer should ensure they are using version 4.8.4 or later. The vulnerability is introduced through the core application logic, not a third-party dependency. However, any system that uses AdminerEvo as a dependency in a larger PHP application is also affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply sends a crafted request.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its original authorization scope (e.g., internal network).
• Confidentiality (C): High (H) – The attacker can read sensitive data from internal services.
• Integrity (I): None (N) – The attacker cannot modify data.
• Availability (A): None (N) – The attack does not affect availability.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Base Score: 8.6 (High)

Deep Dive & Mechanics

The vulnerability exists in the database connection logic of AdminerEvo. When a user connects to a database, the application accepts various connection parameters (e.g., server hostname, port, username, password). The server field is particularly dangerous because it is used to construct a connection string that is passed to PHP's mysqli_connect or similar functions. However, the application does not properly validate or sanitize this input.

An attacker can supply a URL or IP address in the server field that points to an internal service (e.g., http://169.254.169.254 for cloud metadata, or http://internal-service:8080). When the application attempts to connect, it will make an HTTP request to that address, effectively performing an SSRF. The response from the internal service may be reflected back to the attacker in error messages or other output, allowing data exfiltration.

The attack does not require authentication because the login page is publicly accessible. The attacker only needs to access the AdminerEvo interface and manipulate the connection form.

Vulnerable vs. Patched Code

Vulnerable Code (AdminerEvo < 4.8.4):

In the vulnerable version, the server parameter is used directly in the connection function without validation:

// vulnerable: no validation on $server
$connection = new mysqli($server, $username, $password, $database);

Patched Code (AdminerEvo 4.8.4):

The patched version introduces a validation function that checks if the server parameter is a valid hostname or IP address and rejects URLs or other unexpected formats:

// patched: validate server parameter
if (!preg_match('/^[a-zA-Z0-9.-]+$/', $server)) {
    throw new Exception('Invalid server parameter');
}
$connection = new mysqli($server, $username, $password, $database);

The patch also restricts the allowed characters and prevents the use of schemes like http:// or ftp://.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy AdminerEvo version 4.8.3 (vulnerable) on a PHP-enabled web server (e.g., Apache, Nginx).
2. Ensure the server has network access to internal services (e.g., a metadata endpoint simulator or an internal HTTP server).
3. Access the AdminerEvo login page.

Exploitation Steps:

1. Open the AdminerEvo login page.
2. In the "Server" field, enter a target internal URL, such as http://169.254.169.254/latest/meta-data/ (for AWS) or http://internal-service:8080/.
3. Leave other fields as default or fill with dummy data.
4. Click "Login" or "Connect".
5. The application will attempt to connect to the specified URL. If the target responds, the response may be displayed in an error message or the connection result.

Example Request (using Burp Suite or cURL):

POST /adminer.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

auth[server]=http://169.254.169.254/latest/meta-data/&auth[username]=test&auth[password]=test&auth[db]=test

Blue Team

Detection:

• Monitor for unusual server parameter values in AdminerEvo login requests, especially those containing http://, https://, or internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Look for outbound HTTP requests from the web server to unexpected internal IPs or cloud metadata endpoints.
• Use network segmentation to restrict the web server's outbound access to only necessary services.

Mitigation:

• Immediately upgrade to AdminerEvo version 4.8.4 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with server parameters containing URL schemes or internal IPs.
• Restrict outbound network access from the web server using firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the web server to 169.254.169.254 (cloud metadata).
  • Outbound HTTP requests to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x).
  • Requests to AdminerEvo login page with server parameter containing http:// or https://.

• File IOCs:

  • AdminerEvo PHP file (e.g., adminer.php) with version < 4.8.4.

• Log IOCs:

  • Web server access logs showing POST requests to /adminer.php with unusual server values.
  • PHP error logs containing connection attempts to internal IPs.

Detection Engineering

YARA Rule

rule Detect_AdminerEvo_SSRF_CVE_2023_45195 {
    meta:
        description = "Detects AdminerEvo PHP files vulnerable to SSRF (CVE-2023-45195)"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:example"
    strings:
        $vuln_func = "new mysqli("
        $vuln_param = "$server"
        $no_validation = "!preg_match('/^[a-zA-Z0-9.-]+$/', $server)"
    condition:
        $vuln_func and $vuln_param and not $no_validation
}

Sigma Rule

title: AdminerEvo SSRF Attempt (CVE-2023-45195)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts against AdminerEvo by monitoring for suspicious server parameters in login requests.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/adminer.php'
        cs-uri-query|contains: 'auth[server]=http://'
    condition: selection
falsepositives:
    - Legitimate use of external database servers (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-45195 AdminerEvo SSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/adminer.php"; http_uri; content:"auth[server]=http://"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Upgrade: Upgrade AdminerEvo to version 4.8.4 or later. This is the only complete fix.
2. Network Segmentation: Restrict outbound HTTP access from the web server to only necessary external services. Block access to internal IP ranges and cloud metadata endpoints.
3. WAF Rules: Deploy a Web Application Firewall (WAF) to block requests containing auth[server]=http:// or auth[server]=https:// in the POST body.
4. Input Validation: If upgrade is not possible, manually patch the adminer.php file to validate the server parameter as shown in the patched code example.
5. Monitoring: Enable logging and alerting for unusual outbound connections from the web server.

Report generated by Valters IT DevSecOps & CTI Expert System