Loading vulnerability…
CVE-2021-21311 is a server-side request forgery (SSRF) vulnerability in Adminer, the single-file PHP database administration tool. According to the provided content, Adminer versions 4.0.0 through 4.7.8 are affected, specifically builds bundling all drivers such as adminer.php. The flaw allows a remote unauthenticated attacker to coerce the application into issuing arbitrary HTTP GET requests to attacker-chosen internal endpoints. In cloud-hosted deployments, this can be used to reach otherwise inaccessible services such as the AWS Instance Metadata Service (IMDS) at 169.254.169.254 and retrieve sensitive metadata and temporary credentials.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository provides a proof-of-concept exploit for CVE-2021-21311, an SSRF vulnerability in Adminer (versions 4.0.0 to 4.7.8). The main exploit is implemented in 'exploit.py', which sets up a local HTTP server to issue redirects and sends a crafted POST request to the target Adminer instance to trigger SSRF. The exploit allows an attacker to make the Adminer server request arbitrary URLs, potentially accessing internal resources such as AWS S3 buckets. The repository includes Terraform scripts to provision a vulnerable AWS environment, including an EC2 instance running Adminer and an S3 bucket with a sensitive file, to demonstrate the impact of the exploit. The exploit is network-based and requires the attacker to have network access to the Adminer instance. The code is written in Python and Terraform, with 'exploit.py' as the main entry point. No evidence of weaponization or framework integration is present; this is a standalone proof-of-concept.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A server-side request forgery vulnerability in Adminer, still exploited in cloud environments for internal database access.
A server-side request forgery (SSRF) vulnerability in Adminer database management tool, enabling attackers to access internal resources or exfiltrate sensitive data via crafted HTTP requests.
A high-severity SSRF vulnerability in Adminer (versions 4.0.0 to <4.7.9) allowing attackers to proxy requests to internal resources, potentially enabling lateral movement or reconnaissance.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.