Dbx
Monthly
Authentication bypass in the dbx-web backend of the dbx database client (all versions prior to 0.5.51) lets unauthenticated network attackers reach protected API routes. When DBX_PASSWORD is unset and no stored password exists, auth_middleware treats a None password_hash as 'allow everything' and forwards every request to the handler chain, while the service listens on 0.0.0.0:4224 by default. Attackers can invoke /api/connection/connect and /api/query/execute to abuse configured database credentials and run arbitrary SQL. No public exploit has been identified at time of analysis, but the fix is confirmed in release v0.5.51 and the root cause is visible in the published commit.
Authentication bypass in the dbx-web backend of the dbx database client (all versions prior to 0.5.51) lets unauthenticated network attackers reach protected API routes. When DBX_PASSWORD is unset and no stored password exists, auth_middleware treats a None password_hash as 'allow everything' and forwards every request to the handler chain, while the service listens on 0.0.0.0:4224 by default. Attackers can invoke /api/connection/connect and /api/query/execute to abuse configured database credentials and run arbitrary SQL. No public exploit has been identified at time of analysis, but the fix is confirmed in release v0.5.51 and the root cause is visible in the published commit.