Description

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST containing 'SELECT version()' to that host. In rootQuery(), if the target returns a status outside 200-299 (other than 401/403), the raw HTTP response body is assigned to the connection error and rendered on the login page, so the attacker receives the full response body of the internal service. This enables internal network/port reconnaissance and disclosure of sensitive information contained in internal error pages (stack traces, internal hostnames, file paths, configuration identifiers). Fixed in Adminer 6.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-26T14:16:54.583Z",
  "pubdate": "2026-09-26T14:16:54.583Z",
  "executiveSummary": "Adminer versions 6.0.0 through 6.0.1 are susceptible to an unauthenticated Server-Side Request Forgery (SSRF) vulnerability when utilizing the ClickHouse driver plugin. This flaw originates from improper input validation within the driver's connection handling logic, allowing an unauthenticated attacker to coerce the server into performing arbitrary HTTP POST requests against internal network resources.\nThe vulnerability allows an attacker to interact with services reachable from the Adminer server's network perspective, even if those services are not exposed to the public internet. By manipulating the 'auth[server]' parameter, an attacker can perform internal port scanning and service discovery. Furthermore, the application's error handling mechanism reflects raw response bodies from these internal requests back to the user interface, facilitating the exfiltration of sensitive information, such as internal stack traces, configuration identifiers, and infrastructure metadata.\nThe impact is significant, as it permits reconnaissance of internal networks and the potential disclosure of confidential data stored on private systems. Because exploitation requires no prior authentication, it poses a substantial risk to internal network segmentation and overall system security. Organizations currently running Adminer 6.0.0 or 6.0.1 are advised to upgrade to version 6.0.2 to remediate this vulnerability.",
  "technicalDetails": "The vulnerability resides in the ClickHouse driver implementation located at plugins/drivers/clickhouse.php, which was introduced in version 6.0.0. The root cause is the lack of validation for the 'auth[server]' input parameter, which specifies the destination for the driver's connection requests. When the driver is active, the application utilizes this input to initiate an HTTP POST request to the provided address without adequate sanitization or restrictiveness regarding internal hostnames or IP addresses.\nThe attack flow begins when an unauthenticated attacker targets the Adminer login interface. By submitting a crafted request where 'auth[driver]' is set to 'clickhouse' and 'auth[server]' is directed at an arbitrary internal URI (e.g., http://127.0.0.1:18089), the attacker triggers the server-side request. The application forces the backend server to dispatch an HTTP POST request containing a default query payload—specifically 'SELECT version()'—to the specified destination.\nA critical aspect of the exploitation is the vulnerability in the 'rootQuery()' function. Upon receiving a response from the targeted internal resource, the application evaluates the HTTP status code. If the status code is outside the 200-299 range (excluding 401 Unauthorized and 403 Forbidden responses), the application captures the raw, unprocessed HTTP response body and assigns it to the connection error variable. This variable is subsequently rendered directly within the login page's user interface.\nThis behavior converts the Adminer server into a blind proxy for internal network reconnaissance. An attacker can observe differences in the rendered error responses to confirm the existence of specific services, determine open ports, and extract potentially sensitive internal data contained within those error bodies, such as local file paths, internal network topologies, or configuration-specific debugging information. The absence of authentication requirements makes this a highly accessible vector for an attacker with network reach to the Adminer instance."
}