PostgreSQL Default Credentials Exposure via VPS.org Supabase Template

Executive Summary

This vulnerability involves a VPS.org one-click Supabase template that deploys a PostgreSQL database instance. The database is exposed on all network interfaces (0.0.0.0:5432) with a default password set to 'postgres'. Docker's iptables rules override host UFW firewall settings, allowing unauthorized access to the database.

Useful 0 Not Useful 0

Detection Guidance

Check if PostgreSQL is listening on all interfaces (0.0.0.0:5432) by running: netstat -tulnp | grep 5432 or ss -tulnp | grep 5432. Verify if the default password 'postgres' is set by attempting to connect locally: psql -U postgres -h 127.0.0.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to connect to the PostgreSQL database remotely due to its exposure on all interfaces. They can exploit the default password to gain unauthorized access, potentially leading to data theft, manipulation, or deletion.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements such as GDPR and HIPAA, which mandate strict data protection and access controls. Unauthorized database exposure risks data breaches, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Change the default PostgreSQL password immediately using ALTER USER postgres WITH PASSWORD 'new_strong_password';. Restrict PostgreSQL to listen only on localhost by editing postgresql.conf to set listen_addresses = 'localhost'. Update firewall rules to block external access to port 5432.

Useful 0 Not Useful 0