Sanghyeon Lee

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions 6.2 through 9.17 **Description** An authentication bypass exists when the 'webserver' source is enabled in `AUTHENTICATION SOURCES`. The `WebserverAuthentication.get user()` function reads the `config.WEBSERVER REMOTE USER` from the environment and, if empty, falls back to reading the same name directly from inbound HTTP request headers via `request.headers.get()`. Because HTTP headers are client-controlled, an attacker can supply a specific header to be authenticated as any user, including an Administrator, without providing a password. This also occurs if `WEBSERVER REMOTE USER` is configured with an HTTP-prefixed or hyphenated name, as WSGI servers place inbound headers into the environment using those formats. **Recommendations** Update pgAdmin 4 to version 9.18 or later. As a temporary mitigation, disable 'webserver' in `AUTHENTICATION SOURCES` if it is not required.

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions prior to 9.18 **Description** The Backup tool in pgAdmin 4 fails to validate the `database` field within the `/backup/job/<sid>/object` endpoint. This field is appended as a positional argument to the `pg dump` utility. Since `pg dump` uses `getopt long` for argument parsing, an attacker can provide a value starting with a dash to inject options. For example, using `--file=/absolute/path` allows the utility to write output to arbitrary locations accessible by the pgAdmin process, enabling arbitrary file creation and overwrite. Additionally, the `database` field allows connection-string injection because `libpq` expands names containing equals signs into full connection strings. This allows an attacker to redirect `pg dump` to a remote server, potentially leaking the decrypted database password stored in the `PGPASSWORD` environment variable. These actions can be performed by any authenticated user with `tools backup` permissions. **Recommendations** Update pgAdmin 4 to version 9.18 or later.