CVE-2022-4223

Vulnerability

Overview

CVE-2022-4223 is a security flaw in pgAdmin, an open-source administration and management tool for PostgreSQL. The vulnerability resides in an HTTP API endpoint intended to validate the path to external PostgreSQL utilities such as pg_dump and pg_restore. Versions prior to 6.17 did not properly secure this API, allowing an unauthenticated attacker to supply an arbitrary path, including a UNC path on Windows systems [1][2]. When the server's utility path validation process executes the binary at the provided path, an attacker-controlled executable can be run with the privileges of the pgAdmin server process [1].

Attack

Vector and Prerequisites

The vulnerability is exploitable without authentication over the network. On Windows, an attacker can specify a UNC path to a remote server they control, causing the pgAdmin server to connect to that remote share and execute a maliciously named executable file (e.g., pg_dump.exe). No special privileges or user interaction beyond being able to reach the pgAdmin server's HTTP endpoint are required [1]. The attack surface is limited to Windows deployments due to the UNC path requirement, but the vulnerability is classified as critical with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) [1].

Potential

Impact

Successful exploitation leads to remote code execution on the pgAdmin server. An attacker could then compromise the confidentiality, integrity, and availability of the system—potentially gaining access to database credentials, modifying or exfiltrating data, or pivoting to other internal resources. Because the vulnerable endpoint is exposed without authentication, the impact is severe, particularly in environments where pgAdmin is accessible from untrusted networks [1].

Mitigation

Status

The pgAdmin project addressed this vulnerability in version 6.17 by properly restricting the utility path validation API. Users should upgrade to pgAdmin 6.17 or later immediately. No workaround is available for earlier versions [1][2]. As of this writing, the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, but given the high severity and ease of exploitation, prompt patching is strongly recommended.