Dbgate
Monthly
Arbitrary file read and write in DbGate through version 7.2.6 allows authenticated low-privilege users to escape the application's data directory by supplying file:// scheme URIs in the jslid parameter of the jsldata controller. The root function getJslFileName() performs no directory containment validation, exposing the full server filesystem to the DbGate process's OS-level permissions. The most critical consequence is exfiltration of encrypted database credentials from the connections configuration, enabling lateral movement to every database managed through the tool; the write primitive adds configuration tampering and potential code-plant risk.
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious script via the applicationIcon argument in FontIcon.svelte, executing arbitrary JavaScript in a victim user's browser session. Affected versions span 7.1.0 through 7.1.4, with a confirmed fix released in v7.1.5. A public proof-of-concept exploit has been disclosed via VulDB, though EPSS at 0.03% (9th percentile) and SSVC's 'exploitation: none' designation indicate no observed active exploitation at time of analysis.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.
Arbitrary file read and write in DbGate through version 7.2.6 allows authenticated low-privilege users to escape the application's data directory by supplying file:// scheme URIs in the jslid parameter of the jsldata controller. The root function getJslFileName() performs no directory containment validation, exposing the full server filesystem to the DbGate process's OS-level permissions. The most critical consequence is exfiltration of encrypted database credentials from the connections configuration, enabling lateral movement to every database managed through the tool; the write primitive adds configuration tampering and potential code-plant risk.
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious script via the applicationIcon argument in FontIcon.svelte, executing arbitrary JavaScript in a victim user's browser session. Affected versions span 7.1.0 through 7.1.4, with a confirmed fix released in v7.1.5. A public proof-of-concept exploit has been disclosed via VulDB, though EPSS at 0.03% (9th percentile) and SSVC's 'exploitation: none' designation indicate no observed active exploitation at time of analysis.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.