Cybersecurity researchers have disclosed a critical vulnerability in the PostgreSQL open-source database system that could allow attackers to manipulate environment variables, potentially leading to arbitrary code execution or information disclosure.
Tracked as CVE-2024-10979, this flaw has received a high CVSS score of 8.8 and impacts several versions of PostgreSQL, including versions 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21. The vulnerability is particularly dangerous because it allows unprivileged database users to modify sensitive process environment variables, such as PATH, within PostgreSQL's PL/Perl.
What Is the Vulnerability?
Environment variables are user-defined values that provide essential information during program execution, such as access keys, software paths, and more. In PostgreSQL, incorrect handling of these environment variables in PL/Perl can give an attacker the ability to alter these variables, even if they lack OS-level privileges.
By manipulating environment variables, an attacker could execute arbitrary code or extract sensitive information from the system, posing significant security risks to the database and the server it resides on.
Potential Impact
- Arbitrary Code Execution: Altering environment variables like PATH can allow attackers to execute arbitrary code.
- Information Disclosure: Attackers could use the vulnerability to run malicious queries and extract valuable information from the system.
The vulnerability was discovered by researchers Tal Peleg and Coby Abrams from Varonis. They warned that depending on the attack scenario, the flaw could lead to severe security incidents.
Mitigation and Recommendations
The vulnerability has been addressed in the latest PostgreSQL releases (17.1, 16.5, 15.9, 14.14, 13.17, 12.21). Users are urged to update their PostgreSQL installations as soon as possible.
Additionally, to reduce the risk, Varonis recommends:
- Restricting the ability to create extensions, limiting the CREATE EXTENSIONS permission to trusted extensions.
- Setting the shared_preload_libraries parameter to load only essential extensions.
- Adopting the principle of least privilege by limiting roles from creating functions, especially through restricting the CREATE FUNCTION permission.
PostgreSQL administrators should prioritize applying the patches to mitigate the risk posed by CVE-2024-10979. Ensuring a secure environment for running PostgreSQL can protect against potential exploitation and reduce the impact of any future attacks targeting this vulnerability.
