DbGate vulnerabilities

DbGate versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.

In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.

DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.

DbGate is a cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint interpolates the functionName parameter directly into a JavaScript code template without sanitization. An authenticated user can inject arbitrary JavaScript code that executes on the server with full Node.js process privileges, bypassing sandbox restrictions.

DbGate versions 7.0.0 through 7.1.4 have a stored XSS vulnerability because attacker-controlled SVG icons are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app it can escalate to local code execution.