PostgreSQL SCRAM Authentication User Existence Leak

Executive Summary

This vulnerability in PostgreSQL involves SCRAM authentication. An unauthenticated attacker can check if a user exists by observing differences in the SCRAM iteration count during login attempts. It only works if the user being probed has a non-default scram_iterations setting, as non-existent users return the default count.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check PostgreSQL server logs for authentication attempts that show discrepancies in SCRAM iteration counts. Use commands like 'pg_ctl status' to verify PostgreSQL version and 'psql -c SHOW scram_iterations;' to inspect user-specific iteration settings. Compare these against default values to identify anomalies.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to determine if specific user accounts exist in your PostgreSQL database. This may aid further attacks like brute force or social engineering by confirming valid usernames.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized disclosure of user existence through information leakage. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. The flaw allows attackers to infer user presence, which may constitute a privacy violation if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update PostgreSQL to patched versions: 18.5, 17.11, or 16.15. Disable unnecessary user accounts and review SCRAM iteration settings to ensure no non-default values exist. Monitor authentication logs for suspicious activity indicating probing attempts.

Useful 0 Not Useful 0