Adminer: Arbitrary file read via rogue MySQL server (CVE-2020-35572)

CVE-2020-35572 allows an unauthenticated attacker to perform arbitrary file reads on the server hosting Adminer. By forcing the Adminer application to connect to a rogue MySQL server controlled by the attacker, the application can be instructed to execute the 'LOAD DATA LOCAL INFILE' command, exfiltrating contents of arbitrary files from the target filesystem to the attacker's database. A functional proof-of-concept exploit module has been identified and linked to the Kittysploit framework.

Attack Chain

1. Attacker initializes a rogue MySQL server accessible from the target Adminer host.
2. Attacker identifies the target Adminer instance (e.g., /adminer.php).
3. Attacker triggers a connection from the target Adminer instance to the rogue MySQL server by submitting the rogue server address in the 'auth[server]' field via a POST request.
4. Adminer performs a handshake with the rogue MySQL server.
5. Attacker observes the connection and obtains the SQL token required for subsequent administrative operations.
6. Attacker sends a POST request containing a malicious SQL query: 'LOAD DATA LOCAL INFILE "[path]" INTO TABLE [table]'.
7. Adminer reads the file from its local filesystem and transmits the content to the rogue MySQL server.
8. Attacker retrieves the exfiltrated data by querying the rogue MySQL database.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive files (e.g., /etc/passwd or configuration files) from the server hosting the vulnerable Adminer instance, potentially leading to full system compromise.

Recommendation

• Patch Adminer to a version beyond 4.7.8 immediately.
• If patching is not possible, restrict access to the Adminer interface to trusted IP addresses using firewall rules or web server access control lists.
• Disable the 'LOAD DATA LOCAL' functionality in the MySQL client configuration on the server if not required.
• Monitor for unexpected outbound network connections initiated by the web server service account.