SSRF patch bypass in latest version (4.7.7)
Database management in a single PHP file
Brought to you by:
jakubvrana
The latest version of Adminer can be abused as a HTTP client by using the ClickHouse driver.
The current fix for the SSRF issue is a simple check that verifies if the specified port is a privileged one.
This can be bypassed by using URL comments, or even slashes. For example, if you set the server parameter to:
"localhost:80#"
It will bypass the check, and allow for the malicious actor to hit internal, privileged ports.
Fixed, thanks.