mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-17 16:34:44 -05:00
Ashesh Vashi
f81433ae2f
The 'close' (DELETE /sqleditor/close/<trans_id>) and 'update_sqleditor_connection' (POST /sqleditor/initialize/sqleditor/ update_connection/...) endpoints were the only state-mutating SQL Editor routes missing @pga_login_required. Both reach pickle.loads on session['gridData'][trans_id]['command_obj'] via close_sqleditor_session() and check_transaction_status() respectively. Combined with a forged session file (precondition: SECRET_KEY leak + write access to sessions/), this gave an unauthenticated attacker a pickle deserialization sink and arbitrary code execution in the pgAdmin process. Adding the login decorator forces is_authenticated/MFA checks before the unsafe deserialization path is reached, matching the convention used by every other endpoint in the module. Includes a server-mode regression test that harvests a CSRF token from GET /login (mirroring the attacker's path) and asserts both endpoints reject the unauthenticated request before reaching the route body. Self-skips in DESKTOP mode because pgAdmin's before_request hook re-authenticates DESKTOP_USER on every request there, so no auth decorator can be exercised in an unauthenticated state. Wired into the existing server-mode CI workflow alongside the data-isolation tests. Reported by Fernando Bortotti <fernando.bortotti@bsd.com.br>.