Description

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-09-26T14:16:54.730Z",
  "pubdate": "2026-09-26T14:16:54.730Z",
  "executiveSummary": "Adminer versions 5.5.1 through 6.0.1 contain a critical Server-Side Request Forgery (SSRF) vulnerability due to flawed input sanitization of the login server parameter.\nThe vulnerability allows remote, unauthenticated attackers to bypass security restrictions intended to prevent connections to privileged internal ports.\nBy submitting a specially crafted server string, an attacker can coerce the Adminer server into initiating TCP connections to arbitrary internal infrastructure.\nThis behavior facilitates blind port scanning, allowing attackers to map internal networks by observing connection responses, such as handshake errors or timeouts, acting as a liveness oracle.\nThe flaw stems from a regression in the host_port() function's regex parsing logic within adminer/include/functions.inc.php, which fails to correctly identify port identifiers when non-digit characters are appended to the host string.\nSuccessful exploitation requires reachability to the Adminer login interface. As the connection occurs before credential validation, no authentication is required to perform the SSRF request. This represents a significant security risk for internal network segmentation and service discovery.",
  "technicalDetails": "The root cause of this vulnerability lies in the regex implementation within the host_port() function located in adminer/include/functions.inc.php. The function attempts to extract the port from the server input string; however, the regex pattern expects the port capture group to contain only digits and to be anchored precisely at the end of the input string.\nWhen a user provides a server string containing non-digit characters at the end (e.g., '127.0.0.1:80/x'), the regex validation fails. Consequently, the function falls back to returning the entire input string as the host identifier and returns an empty value for the port.\nThis logic failure is significant because the privileged-port restriction, defined in adminer/include/auth.inc.php, relies exclusively on the output of this flawed host_port() parsing function to decide whether a connection request is permitted. Because the port is perceived as empty, the application skips the security check intended to block connections to privileged ports.\nUpon receiving the request, the underlying mysqlnd or mysqli client driver receives the full, unparsed string. Unlike the Adminer security logic, these drivers are capable of parsing the 'host:port' format even when trailing characters are present. This allows the driver to initiate a TCP connection to the specified target host and port.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker accesses the Adminer login page. 2) The attacker submits a malicious server payload, such as '127.0.0.1:80/x'. 3) The host_port() function fails to isolate the port '80', resulting in a null port return. 4) The authentication middleware in auth.inc.php bypasses the privileged-port check because no port is detected. 5) The MySQL client initiates the TCP connection to the specified internal IP and port. 6) The attacker analyzes the response (e.g., connection refused vs. successful handshake vs. timeout) to identify active services or internal network topology.\nThis vulnerability is a regression of GHSA-58cq-mgw2-38m5, indicating that the initial patch was insufficient to cover edge cases where URI-style suffixes are appended to the server string. The vulnerability impacts Adminer versions 5.5.1 through 6.0.1 and was remediated in version 6.0.2."
}