abraxas/phpmyadmin-webauthnphpMyAdmin 5.2.3 - High - Remote - 2FA skip - WebAuthn ceremony can be skipped
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · phpmyadmin-webauthn
Class: 2FA bypass Reach: Remote
phpMyAdmin 5.2.3 (tag RELEASE_5_2_3). Default tarball. web-auth/webauthn-lib is suggest / require-dev. composer install --no-dev does not install it. createServer therefore uses CustomServer. That class parses response.signature (the field must exist and decode) and never COSE-verifies it. It never uses the stored credentialPublicKey. The product's own CustomServerTest accepts an assertion with no public key.
Structural checks are real: credential id in allowCredentials, clientData.type == webauthn.get, challenge matches session, origin host, rpIdHash, user-present. Signature is parsed and ignored. After the MySQL password, a garbage WebAuthn signature that still matches those fields is a full phpMyAdmin session. That is the database. If you actually installed web-auth/webauthn-lib, you are on WebauthnLibServer and not this bug.
| ID | no CVE yet |
| Class | 2FA bypass / missing signature verify |
| Reach | Remote (cookie login, then WebAuthn skipped) |
| CWE | CWE-347, CWE-287 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| Product | phpMyAdmin |
| Affected | 5.2.3 tag RELEASE_5_2_3. Default tarball / composer install --no-dev |
| Auth | Cookie login (MySQL password), then WebAuthn skipped |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18080 only |
They still need the MySQL password (cookie login). After that password, they POST webauthn_request_response with matching challenge, origin host, rpIdHash, user-present, enrolled credential id, and a garbage signature. They land in the normal UI. 2FA is gone. That is the database (SQL, users, export), not a PHP shell on the host.
If you actually installed web-auth/webauthn-lib, you are on WebauthnLibServer and not this bug.
| Privilege | Method / path | Lab-proven or inferred |
|---|---|---|
| Complete WebAuthn 2FA without the authenticator (integrity of second factor) | POST webauthn_request_response after password, garbage signature | Lab-proven. still_2fa=False landed=True |
| Full PMA as that MySQL user (integrity + recon of the SQL box) | same session | Lab-proven. Home UI markers present |
| Skip the MySQL password | unauthenticated POST | Lab-proven closed. Stays on login |
Same bypass with web-auth/webauthn-lib installed | WebauthnLibServer | Closed. Not this leftover |
| OS RCE / reverse shell | this leftover | Closed |
Closed on this leftover: unauthenticated PMA, a PHP shell on the host, and treating a tarball that actually installed web-auth/webauthn-lib as this bug.
I read createServer, then parseAndValidateAssertionResponse, then the unit test that does not pass a public key. Structural checks are real. Signature is parsed and ignored.
Wrong turns: POSTing WebAuthn JSON without a prior password session; a signature that failed the structural checks; Webauthn\Server still present (wrong server class); challenge not from this session; origin host mismatch; user-present flag clear; credential id not in allowCredentials.
The lab Dockerfile copies 5.2.3, composer install --no-dev, then deletes vendor/web-auth so CustomServer is the one in play. The last php -r exits 1 if Webauthn\Server exists. init.sql enrolls WebAuthn 2FA for appuser without a hardware key. The PoC POSTs signature not-a-real-signature-PMA-WEBAUTHN-BYPASS.
Clone the pin next to the Dockerfile, then run:
cd lab
git clone --depth 1 --branch RELEASE_5_2_3 https://github.com/phpmyadmin/phpmyadmin.git src
./run.sh
or from pack root after that clone:
python3 phpmyadmin-webauthn-Abraxas-Labs.py
Loopback only: http://127.0.0.1:18080. Compose project pma-webauthn-lab. Pin RELEASE_5_2_3. Do not ship src/. Witness PMA-WEBAUTHN-BYPASS.
SUCCESS PMA-WEBAUTHN-BYPASS WebAuthn 2FA accepted with garbage signature
Verify authenticatorData || SHA-256(clientDataJSON) with the stored COSE public key; bind userHandle; enforce signCount. Make web-auth/webauthn-lib a real dependency and delete CustomServer, or fail closed if the library is missing. Until then, disable WebAuthn 2FA or do not expose this phpMyAdmin.
Plugins\TwoFactor\WebAuthn::createServerCustomServer::parseAndValidateAssertionResponseGNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.