p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in poweradmin/poweradmin

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für poweradmin/poweradmin: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 5

  1. GHSA-cmwh-g2h8-c222

    Hoch · CVSS 8.1Korrektur verfügbar

    Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

    ## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`. In the MySQL schema, the OIDC link table explicitly uses `utf8mb4_unicode_ci`, which is case-insensitive and accent-insensitive. OIDC `sub` is a stable external subject identifier and should be matched byte-for-byte within the issuer/provider scope. The confirmed local PoC used two different OIDC users: - Victim subject: `victim-login` - Attacker subject: `victím-login` (`í`, U+00ED) MySQL reported those two subjects as equal under `utf8mb4_unicode_ci`. After the victim linked their OIDC account, the attacker authenticate

    poweradmin/poweradmin poweradmin/poweradminPHP
    • Auf 4.2.5 aktualisieren
    • Auf 4.3.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. GHSA-rm67-g9ch-vxff

    Hoch · CVSS 8.1Korrektur verfügbar

    Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

    ## Affected software - Product: Poweradmin (web front-end for PowerDNS) - Version tested: master, commit 7f28c3a97 (also reachable in the 4.x release line — the record-edit code is the same) - Component: record editing (web UI) - Vulnerability type: Broken Access Control / Insecure Direct Object Reference ## Severity Any authenticated user who owns at least one zone can tamper with records in every other zone on the server. In a shared/multi-tenant Poweradmin install this is effectively a cross-tenant DNS takeover. ## Summary When you save a record edit, Poweradmin checks whether you're allowed to touch the record by looking at a zone id

    poweradmin/poweradmin poweradmin/poweradmin poweradmin/poweradminPHP
    • Auf 3.9.11 aktualisieren
    • Auf 4.2.5 aktualisieren
    • Auf 4.3.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. GHSA-h4hf-v6w5-897x

    Hoch · CVSS 8.8Korrektur verfügbar

    Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

    ### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce two authorization rules that the web interface enforces. A user who holds the `user_edit_others` permission but is not a superuser can: 1. edit user accounts that belong to a superuser, and 2. set the password of any account, even without the `user_passwd_edit_others` permission. Because of this, a non-admin "user manager" role can send a single API request that changes the administrator's password, then log in as the administrator. This is a full privilege escalation and account takeover. The same actions are explicitly bl

    poweradmin/poweradmin poweradmin/poweradminPHP
    • Auf 4.2.5 aktualisieren
    • Auf 4.3.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-54588

    Kritisch · CVSS 9.6EPSS 0,54%Korrektur verfügbar

    Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

    Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

    poweradmin/poweradmin poweradmin/poweradminPHP
    • Auf 4.2.4 aktualisieren
    • Auf 4.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-47693

    Mittel · CVSS 6.9EPSS 0,38%Korrektur verfügbar

    Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

    Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection (Formula Injection) in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing formula trigger characters (=, +, -, @). When an administrator exports activity logs and opens the resulting CSV in a spreadsheet application (Microsoft Excel, LibreOffice Calc, Google Sheets), any formula stored in a username is executed by the application. This can be used for phishing attacks against administrators or data exfiltration. Versions

    poweradmin/poweradmin poweradmin/poweradminPHP
    • Auf 4.2.4 aktualisieren
    • Auf 4.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →