Type Confusion in PostgreSQL Leads to Arbitrary Code Execution

Executive Summary

This is a type confusion vulnerability in PostgreSQL where an object creator can execute arbitrary code as the operating system user running the database. It occurs primarily through the ALTER ... SET DATA TYPE command but also via other DDL attack routes like 'ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN'. The issue stems from inadequate tracking of typed values, causing stale values to appear in data dictionary entries, PL/pgSQL variables, and other system parts.

Useful 0 Not Useful 0

Detection Guidance

Check PostgreSQL version with 'psql --version' or 'SELECT version();'. Affected versions are before 18.7, 17.12, 16.16, 15.20, and 14.25. Review logs for unusual ALTER commands or DDL operations like 'ALTER TABLE ... ADD COLUMN' followed by ROLLBACK.

Useful 0 Not Useful 0

Impact Analysis

An attacker with database object creation privileges could exploit this to execute arbitrary code with the privileges of the PostgreSQL operating system user. This could lead to full system compromise, data theft, or unauthorized modifications to the database and underlying system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements under GDPR, HIPAA, and other regulations. Organizations using affected PostgreSQL versions may face legal penalties, reputational damage, and increased audit scrutiny.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PostgreSQL to version 18.7 or later, 17.12, 16.16, 15.20, or 14.25 immediately. Restrict database object creation privileges to trusted users only. Monitor for suspicious ALTER or DDL commands in logs.

Useful 0 Not Useful 0