CIS Logo
tagline: Confidence in the Connected World

Multiple Vulnerabilities in PostgreSQL Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2018-128

DATE(S) ISSUED:

11/14/2018

OVERVIEW:

Multiple SQL injection vulnerabilities have been discovered in PostgreSQL that could allow for arbitrary code execution. PostgreSQL is an object-relational database management system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary SQL statements, which could allow them to compromise the application, access or modify data, or exploit other vulnerabilities in the database.

THREAT INTELLIGENCE:

There are currently no reports of this vulnerability being actively exploited in the wild.

SYSTEMS AFFECTED:

  • PostgreSQL versions prior to 11.1 and 10.6

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: HIGH
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: HIGH
Home Users:
LOW

TECHNICAL SUMMARY:

Multiple SQL injection vulnerabilities have been discovered in PostgreSQL that could allow for arbitrary code execution. The vulnerabilities are the result of the application’s failure to sufficiently sanitize user-supplied input before using it in an SQL query. These vulnerabilities allow attackers with the CREATE permission (or Trigger permission in some tables) to exploit input sanitation vulnerabilities in the pg_upgrade and pg_dump functions. The CREATE permission is automatically given to new users on the public schema, and the public schema is the default schema used on these databases. Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary SQL statements, which could them to compromise the application, access or modify data, or exploit other vulnerabilities in the database.

RECOMENDATIONS:

We recommend the following actions be taken:

  • Install the update provided by PostgreSQL immediately after appropriate testing.
  • Verify no unauthorized modifications have occurred on system before applying patch.
  • Monitor intrusion detection systems for any signs of anomalous activity.
  • Unless required, limit external network access to affected products.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Protect Your Systems from Cyber Threats Like This

CIS Control That Helps Avoid This Issue Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation