CVE-2022-4223 pgadmin4 vulnerable to Code Injection
Unauthenticated attackers can execute arbitrary code on the pgAdmin server by manipulating the path used for PostgreSQL utility validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-4223?
CVE-2022-4223 is a high-severity command injection vulnerability in Fedoraproject Fedora, published on 13 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.
Which versions are affected by CVE-2022-4223?
3 open source packages ship an affected version, including pgadmin4. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
pgadmin4 PyPI | All versions | 6.17 |
pgadmin4 PyPI | All versions | 6.17 |
pgadmin4 PyPI | All versions | 6.17 |
Products include Fedoraproject Fedora, Pgadmin Pgadmin 4.
How do I fix CVE-2022-4223?
Upgrade pgadmin4 to 6.17 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-4223 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-4223 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as GHSA-3v6v-2x6p-32mc, PYSEC-2026-893.