Authorization Bypass in pgweb API Connect Endpoint

pgweb versions up to and including 0.17.0 contain a critical vulnerability in the POST /api/connect endpoint. When the connect-backend authorization configuration is enabled, the application fails to enforce appropriate access controls. This flaw allows an unauthenticated attacker to supply a custom session identifier and an arbitrary database connection URL. By manipulating these parameters, an attacker can bypass the intended resource-to-database mapping logic and gain unauthorized access to internal database services or other sensitive endpoints that the pgweb instance is capable of reaching. This vulnerability represents a significant risk for environments deploying pgweb as a database management interface, as it effectively allows server-side request forgery (SSRF) and unauthorized data access.

Impact

Successful exploitation allows an attacker to interact with arbitrary databases, potentially leading to unauthorized data exfiltration, modification, or exposure of sensitive internal infrastructure that would otherwise be shielded by the application's authorization layer. Given the nature of the application, this access often provides a foothold for further lateral movement within internal network segments where database servers are hosted.

Recommendation

1. Upgrade all instances of pgweb to a version beyond 0.17.0 immediately.
2. Implement network-level access control lists (ACLs) to restrict access to the pgweb /api/connect endpoint to authorized management workstations only.
3. Deploy the provided Sigma rule to monitor for suspicious POST requests to the /api/connect endpoint that deviate from established baselines.