CVE-2024-9014 - pgAdmin 4 OAuth2 Authentication Bypass Exploit Tools

This repository contains tools to check for and exploit the CVE-2024-9014 vulnerability in pgAdmin 4. The vulnerability allows an attacker to bypass OAuth2 authentication and access sensitive resources.

Tools

1. cve_2024_9014_check.py

This script checks if a target system is vulnerable to CVE-2024-9014 by examining its pgAdmin 4 installation and looking for exposed OAuth2 configurations.

Usage

python3 cve_2024_9014_check.py --url <target_url> [--proxy <proxy_url>] [--output <output_file>]

• --url: Single target URL to check (e.g., http://example.com/).

• --list: File containing a list of target URLs -(one per line).

• --output: File to save the results.

• --proxy: Optional proxy (e.g., http://127.0.0.

Example

python3 cve_2024_9014_check.py --url <target_url> --proxy http://127.0.0.1:8080 --output results.txt

The script will check if the target is running pgAdmin 4 and whether it is vulnerable. Vulnerable targets will have exposed OAuth2 configuration.

Output

2. extract_oauth2_config.py

This script extracts the OAuth2 configuration from a pgAdmin 4 installation. It helps identify whether sensitive OAuth2 credentials are exposed in the HTML source.

python3 extract_oauth2_config.py -u <target_url> [--proxy <proxy_url>] [--output <output_file>]

The script will save the extracted OAuth2 configuration for vulnerable targets in a specified output file.

Output

Requirements

• Python 3.x
• requests library (pip install requests)

⚠️ Disclaimer

This script is intended for authorized security testing and educational purposes only. Ensure you have permission to test the systems you're targeting. Unauthorized access or exploitation of systems is illegal.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Official Channels

• YouTube @rootctf
• X @r0otk3r