Uncontrolled Search Path Element in PostgreSQL

Executive Summary

This vulnerability in PostgreSQL involves an uncontrolled search path element in the CREATE EXTENSION command. An attacker with database-level CREATE privileges can exploit this to execute arbitrary SQL code as the bootstrap superuser. This happens due to schema mishandling in extension scripts, allowing manipulation of object locations via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION is also affected.

Useful 0 Not Useful 0

Detection Guidance

Check PostgreSQL version with 'psql --version' or 'SELECT version();'. If running versions before 18.7, 17.12, 16.16, 15.20, or 14.25, the system is vulnerable. Review extension scripts for schema manipulation via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user".

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control over the PostgreSQL database, leading to unauthorized data access, modification, or deletion. This could compromise confidentiality, integrity, and availability of sensitive data stored in the database.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of regulated data, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade PostgreSQL to versions 18.7, 17.12, 16.16, 15.20, or 14.25 or later immediately. Revoke unnecessary CREATE privileges from untrusted users. Audit and review all extension scripts for potential malicious schema manipulations.

Useful 0 Not Useful 0