Unauthenticated Server-Side Request Forgery in Adminer ClickHouse Driver

Adminer versions 6.0.0 through 6.0.1 contain a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability when the ClickHouse driver plugin (plugins/drivers/clickhouse.php) is active. The vulnerability stems from improper validation of the 'auth[server]' parameter during the login process. An unauthenticated attacker can submit a crafted HTTP request with 'auth[driver]=clickhouse' and a custom 'auth[server]' URL, forcing the Adminer server to issue an HTTP POST request containing 'SELECT version()' to the target host.

When the destination service returns an error status (outside the 200-299 range, excluding 401/403), the Adminer application captures the raw response body and renders it directly on the login page. This behavior allows attackers to perform internal network reconnaissance, scan for open ports, and exfiltrate sensitive information, including internal hostnames, configuration details, and stack traces found in error messages. The vulnerability was addressed in Adminer 6.0.2.

Impact

Successful exploitation allows unauthenticated attackers to map internal network infrastructure and disclose potentially sensitive metadata or configuration information from internal services unreachable from the public internet. This exposure can lead to further exploitation of internal-only systems, lateral movement, or the acquisition of credentials and configuration identifiers.

Recommendation

• Upgrade Adminer to version 6.0.2 or later immediately to patch CVE-2026-100697.
• For environments where upgrading is delayed, use a Web Application Firewall (WAF) to block requests containing 'auth[driver]=clickhouse' where the 'auth[server]' parameter targets internal RFC1918 address spaces.
• Monitor web server logs for high volumes of POST requests to Adminer login pages containing unexpected values in the 'auth[server]' or 'auth[driver]' fields.
• Audit access logs for requests to the Adminer login endpoint that result in 200 OK responses containing error bodies typically associated with internal service probe responses.