CyberRota Analysis
AI-GeneratedThe vulnerability in pgweb versions up to 0.17.0 exposes the POST /api/connect endpoint, allowing attackers to submit arbitrary database connection strings when connect-backend authorization is configured. This flaw enables unauthorized access to databases and internal services by bypassing resource-to-database mappings through custom session identifiers. Organizations using affected versions should prioritize remediation to prevent potential data breaches and unauthorized access to sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection URL to access unauthorized databases and internal services.