Cybersecurity researchers at Varonis have identified a serious security vulnerability in PostgreSQL that could lead to data breaches and system compromise. Learn about the technical details, affected versions, and how to mitigate this threat.
Tal Peleg and Coby Abrams, cybersecurity researchers at Varonis, have discovered a high-severity vulnerability in the widely-used open-source database system, PostgreSQL. This vulnerability, tracked as CVE-2024-10979, has the potential to compromise the security of countless databases worldwide.
According to Varonis’ report shared with Hackread.com ahead of publishing on Friday, this vulnerability scores a concerning 8.8 on the CVSS severity scale, which highlights the severity of the flaw. The concerning aspect is that any PostgreSQL version before 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 is vulnerable.
It allows unprivileged users to manipulate environment variables within the PostgreSQL PL/Perl extension. For your information, the PL/Perl extension is a tool that lets you write database functions in the Perl programming language. An attacker could exploit a weakness in this interaction to manipulate environment variables on the server running the database.
“Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. PATH). That often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user.” PostgreSQL explained in the advisory.
Environment variables are like hidden settings that control how programs operate. By altering these variables, an attacker could potentially execute malicious code, eventually stealing data or taking control of the system.
Moreover, environment variables can sometimes hold sensitive details like access keys or file paths. By manipulating these, an attacker could potentially steal valuable information from your database server.
Mitigation strategies include patching your PostgreSQL installation immediately to versions 17.1, 16.5, 15.9, 14.14, 13.17, or 12.21. These updated versions contain the fix for this vulnerability.
Varonis recommends updating PostgreSQL to the latest minor version and restricting allowed extensions. This includes limiting CREATE EXTENSIONS permission grants to specific extensions and setting the shared_preload_libraries configuration parameter to load only required ones. The complete description of the fix is available here.
Furthermore, limit the extensions users can install in your database to prevent attackers from exploiting vulnerabilities and grant users the least privilege to minimize damage.
