CVE-2021-21311
Adminer Server-Side Request Forgery Vulnerability
Description
CVE-2021-21311 is a high-severity server-side request forgery (SSRF) vulnerability in Adminer, a popular open-source database management tool distributed as a single PHP file. The vulnerability affects Adminer versions from 4.0.0 up to but not including 4.7.9, specifically when using the bundled multi-driver version (adminer.php). An unauthenticated attacker can exploit this SSRF flaw to make the server issue requests to arbitrary internal or external endpoints, potentially accessing internal services, cloud metadata APIs, or other resources that should not be externally reachable. CISA has added CVE-2021-21311 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 20, 2025, and its EPSS score of 94.21% at the 99.9th percentile indicates near-certain exploitation activity, making this one of the most actively exploited web application vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| adminer | adminer | >= 4.0.0, < 4.7.9 |
| debian | debian linux | 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
References
- https://github.com/vrana/adminer/commit/ccd2374b0b12bd547417bf0dacdf153826c83351(Patch)
- https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf(Exploit, Third Party Advisory)
- https://github.com/vrana/adminer/security/advisories/GHSA-x5r2-hj5c-8jx6(Patch, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2021/03/msg00002.html(Mailing List, Third Party Advisory)
- https://packagist.org/packages/vrana/adminer(Product, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21311(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2021-21311 is classified under CWE-918 (Server-Side Request Forgery), a weakness where a web application fetches a remote resource based on user-supplied input without properly validating the destination URL. In Adminer, the multi-driver build processes connection parameters that can be manipulated to force the server to issue HTTP requests to attacker-controlled destinations, enabling access to internal network resources and services.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-21311 carries a CVSS v3.1 base score of 7.2 (High severity) with a changed scope (S:C), meaning the SSRF vulnerability in Adminer can affect resources beyond the Adminer application itself. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality is impacted at a low level because the attacker can read responses from internal services, including potentially sensitive data from cloud metadata endpoints (such as AWS EC2 instance credentials), internal APIs, and services bound to localhost. Integrity also faces low impact as the attacker can send crafted requests to internal services, potentially triggering state-changing operations on systems that trust requests originating from the Adminer server. The EPSS score of 94.21% at the 99.9th percentile indicates this vulnerability is almost certainly being exploited at scale, likely by automated scanners and botnets targeting internet-exposed Adminer installations.
Exploit Maturity
CVE-2021-21311 demonstrates extremely high exploit maturity. CISA has confirmed active exploitation by including it in the KEV catalog. Public exploit documentation is available via the Adminer SSRF proof-of-concept PDF published alongside the GitHub security advisory. The EPSS score of 94.21% at the 99.9th percentile places this among the most actively exploited vulnerabilities tracked, indicating widespread automated exploitation. Adminer installations are commonly found on web servers as a lightweight database management tool, and many instances remain exposed on the internet without proper access controls. The combination of no authentication requirement, low attack complexity, and publicly available exploit documentation makes this an extremely high-risk vulnerability that requires immediate remediation.
Remediation
-
Upgrade Adminer to version 4.7.9 or later immediately. This version contains the fix for the SSRF vulnerability. Download the updated version from the official Adminer repository or GitHub releases.
-
Restrict access to Adminer by implementing IP-based access controls or authentication gateways. Adminer should never be exposed directly to the internet. Place it behind a VPN, reverse proxy with authentication, or restrict access to specific management IP addresses using web server configuration.
-
Use single-driver builds if possible. The vulnerability specifically affects the multi-driver bundled version (adminer.php). If you only need MySQL or PostgreSQL support, use the corresponding single-driver build to reduce the attack surface.
-
Audit server logs for signs of SSRF exploitation, including outbound requests to cloud metadata endpoints (e.g., 169.254.169.254), internal IP ranges, or unusual connection patterns originating from the Adminer server. Review web server access logs for suspicious requests to the Adminer endpoint.
-
Implement network-level egress controls on servers hosting Adminer to prevent outbound connections to internal services or metadata endpoints. Configure firewall rules to restrict the server's ability to connect to internal network segments that Adminer should not access.
Technical Details
CVE-2021-21311 is a server-side request forgery (CWE-918) vulnerability in Adminer, the single-file PHP database management tool. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates a network-accessible attack requiring no authentication or user interaction, with a changed scope reflecting the ability to reach resources beyond the Adminer application. The vulnerability exists in the database connection handling logic of the multi-driver Adminer build (adminer.php). When processing connection parameters for database drivers, the application follows redirects or makes HTTP requests to endpoints specified through manipulated input. Because the application does not properly validate or restrict the destination of these requests, an attacker can force the Adminer server to issue HTTP requests to arbitrary internal or external URLs. This enables enumeration of internal network services, extraction of cloud instance metadata, and interaction with internal APIs that trust the server's network identity. The fix in version 4.7.9 adds proper validation to prevent the application from following redirects to unauthorized destinations.
Frequently Asked Questions
Is CVE-2021-21311 being actively exploited?
Yes, extensively. CISA has confirmed active exploitation by adding CVE-2021-21311 to the KEV catalog. The EPSS score of 94.21% at the 99.9th percentile indicates near-certain exploitation, with automated scanners widely targeting internet-exposed Adminer installations.
What products are affected by CVE-2021-21311?
Adminer versions 4.0.0 through 4.7.8 are affected when using the multi-driver bundled build (adminer.php). Debian Linux 9.0 is also listed as affected through its packaged version of Adminer. Single-driver builds may not be affected.
How do I fix CVE-2021-21311?
Upgrade Adminer to version 4.7.9 or later. Additionally, ensure Adminer is not exposed to the internet and is protected behind authentication and network access controls.
How severe is CVE-2021-21311?
CVE-2021-21311 has a CVSS v3.1 base score of 7.2 (High) with a changed scope. While the direct confidentiality and integrity impacts are rated low, the SSRF can be leveraged to access internal services and cloud metadata, potentially leading to full infrastructure compromise through credential theft.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.