Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in the dbx database client software that, if exploited, could allow unauthorized access to connected databases, potentially leading to the disclosure, modification, or destruction of data. The issue arises from a flaw in how the software handles authentication when a password is not set, making it possible for unauthenticated attackers to execute arbitrary SQL commands through specific API routes. The desktop application is not affected, but the web-based component, by default, is accessible over the network.
- Unauthorized database access is possible.
- Remember this affects web-based database tools.
- Confirm if your database client is exposed.
Attack Path
How an attacker could exploit the issue
An attacker could reach this vulnerability by interacting with the dbx-web service over the network. If the service is deployed with an unset password, it will pass all requests to the handler chain without authentication. This exposure allows an unauthenticated attacker to access the /api/connection/connect and /api/query/execute routes. Successful interaction with these routes permits an attacker to execute arbitrary SQL commands against connected databases.
- Unauthenticated network access is required.
- Calls to specific API routes trigger the vulnerability.
- Allows arbitrary SQL execution, leading to data compromise.
Live Threat
Current exploitation, exposure, and threat context
When improperly configured, the dbx database client could expose connected databases to unauthorized network access. If the database password is not set, an unauthenticated attacker could exploit this by sending requests to specific API routes to potentially access, alter, or delete data. The desktop application is not affected due to its loopback-only binding.
- Database credentials and data.
- Unauthenticated network requests.
- Data disclosure, modification, or destruction.
Operational Fix
Recommended remediation, mitigation, and detection steps
Application and infrastructure teams are likely responsible for addressing this critical vulnerability in the dbx database client, especially when deployed as a network-accessible web service. The immediate first step should be to identify all instances of the affected dbx deployment, determine their network reachability and business criticality, and pinpoint the accountable system owner for remediation planning.
- Application owners and infrastructure teams.
- Confirm network exposure and criticality.
- Plan and coordinate remediation efforts.
