Description

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-20T17:18:27.873Z",
  "pubdate": "2026-08-20T17:18:27.873Z",
  "executiveSummary": "An authentication bypass vulnerability exists in dbx prior to version 0.5.51, specifically within the auth_middleware implemented in crates/dbx-web/src/auth.rs. The flaw allows unauthenticated network attackers to completely bypass access controls when the password_hash is set to None. This state is reached on fresh deployments when the DBX_PASSWORD environment variable is unset and no stored password exists.\nCompounding this risk, crates/dbx-web/src/main.rs binds the vulnerable service by default to 0.0.0.0 on port 4224, exposing it to external networks. Consequently, unauthenticated remote attackers can invoke sensitive API endpoints such as /api/connection/connect and /api/query/execute. This grants them the ability to leverage pre-configured database credentials to execute arbitrary SQL commands.\nThe impact of successful exploitation includes unauthorized data disclosure, modification, or complete destruction of data residing in any connected databases. The desktop Tauri variant of the application remains unaffected due to its binding restricted solely to the loopback interface. Remediation requires upgrading to version 0.5.51 or ensuring proper authentication configuration.",
  "technicalDetails": "The vulnerability resides in the authentication middleware of the dbx-web component, specifically located in crates/dbx-web/src/auth.rs. The root cause stems from improper handling of optional authentication states within the middleware logic. Specifically, the auth_middleware function passes every protected HTTP request directly to the underlying handler chain whenever the password_hash variable evaluates to None.\nThis unauthenticated state is triggered natively during fresh deployments under specific conditions: when the DBX_PASSWORD environment variable is left unset during initialization and no previously stored password exists within the application's persistent state. Under these default conditions, the application fails to enforce administrative or user-level access controls for incoming requests.\nNetwork exposure significantly exacerbates this flaw. The initialization logic in crates/dbx-web/src/main.rs configures the web service to bind to all available network interfaces (0.0.0.0) on TCP port 4224 by default, rather than restricting exposure to the local loopback interface (127.0.0.1). This default network binding enables remote, unauthenticated network attackers to reach the application over the network without requiring any prior sessions, credentials, or privileges.\nThe attack flow proceeds as follows: An unauthenticated network attacker identifies an exposed instance of dbx-web running on port 4224 with an uninitialized or unset password. The attacker bypasses authentication entirely because the middleware incorrectly authorizes requests when password_hash is None. The attacker then targets sensitive application routes, specifically issuing HTTP requests to /api/connection/connect and /api/query/execute. By interacting with these endpoints, the attacker can leverage pre-configured database credentials managed by the application.\nThrough these API routes, the attacker executes arbitrary SQL statements against the backend database management system. Post-exploitation impact includes unauthorized data access, exfiltration of sensitive information, data alteration, and destructive database operations depending on the permissions associated with the configured database credentials. Affected software includes all versions of dbx prior to 0.5.51."
}