Privilege Escalation in StackGres Operator

Executive Summary

This vulnerability is a privilege escalation flaw in the StackGres operator. A low-privilege database owner can gain administrator privileges by exploiting unqualified SQL references in the metrics exporter. The exporter runs as a superuser and connects to all databases via superuser dblink sessions. An attacker sets a malicious search_path to execute functions with elevated privileges, enabling arbitrary code execution in the primary PostgreSQL pod.

Useful 0 Not Useful 0

Detection Guidance

Check StackGres operator versions between 1.x and 1.18.8 or 1.19.0-SNAPSHOT. Inspect PostgreSQL logs for unusual `dblink` sessions or superuser queries with unqualified catalog references. Look for database-level `search_path` modifications by low-privilege users.

Useful 0 Not Useful 0

Impact Analysis

An attacker with database ownership can gain full read/write access to all co-located databases. This allows arbitrary code execution in the primary PostgreSQL pod and potential lateral movement within the cluster. The impact includes complete control over the database environment and data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for data protection and privacy such as GDPR and HIPAA. Full control over databases may result in unauthorized data exposure, modification, or deletion, triggering regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Run the metrics exporter as a dedicated non-superuser role with pg_monitor privileges. Schema-qualify all catalog references in queries. Set search_path = pg_catalog in remote dblink sessions. Upgrade to a patched StackGres version if available.

Useful 0 Not Useful 0