#855 Symlink vulnerability when using adminer.version

[Martin Mares]

Adminer creates a file called adminer.version in the temporary directory. First, this is a symlink traversal vulnerability: adminer.version could be a symlink planted by an attacker, leading to overwrite of an arbitrary file writable by the user running Adminer. Second, when multiple instances of Adminer run on the same machine under different UIDs, they fail with a permission denied error if the file was created by a different instance.

[Jakub Vrána]

Would deleting the file first solve both issues?

[Martin Mares]

No, because between deleting the file and creating it again, another process could create its own version.

[Jakub Vrána]

I've added an is_link check. However, the same handling is also used for invalid logins. It's more complicated there. Creating an adminer.invalid symlink by an attacker would disable invalid logins check. In that case, I create adminer.invalid plus some random suffix.

I also delete adminer.version now. The race condition is not critical. Note that Adminer prefers upload_tmp_dir for temporary dir which could be user specific.