Back
PostgreSQL Vulnerability CVE-2025-1094 Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks

PostgreSQL Vulnerability CVE-2025-1094 Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks

WARNING Publication date: 2025-02-14

In December 2024, a sophisticated cyber-attack exploited a zero-day vulnerability in BeyondTrust's Privileged Remote Access and Remote Support products. Concurrently, attackers targeted an SQL injection vulnerability in PostgreSQL, identified as CVE-2025-1094, which allowed for arbitrary code execution via the database's interactive tool, psql. This vulnerability, disclosed by Rapid7, scores an 8.1 on the CVSS scale, highlighting its severity. You can read the annotated CVE report by following the link, it includes a Q & A based on the provided data as well as a A.I. Assistant.

 

Vulnerability Details

CVE-2025-1094 results from the improper handling of invalid UTF-8 characters within PostgreSQL. Attackers exploit this flaw using the psql shortcut command "!", which permits shell command execution. This vulnerability was discovered during investigations into the BeyondTrust exploit (CVE-2024-12356), indicating that both vulnerabilities were likely exploited in tandem to achieve remote code execution.

 

Affected Versions

The vulnerability affects multiple versions of PostgreSQL, with the following versions containing the necessary patches:

  • PostgreSQL 17 (Fixed in 17.3)
  • PostgreSQL 16 (Fixed in 16.7)
  • PostgreSQL 15 (Fixed in 15.11)
  • PostgreSQL 14 (Fixed in 14.16)
  • PostgreSQL 13 (Fixed in 13.19)

 

Checking Your System

To determine if your PostgreSQL installation is vulnerable, execute the following command in your terminal:

 

        psql --version

 

This command will return the version of your PostgreSQL installation. Compare this version to the list of affected versions mentioned above. If your version is earlier than the fixed version for your major release, your system is vulnerable.

 

Performing the Upgrade

If your PostgreSQL installation is vulnerable, it is crucial to upgrade to the latest patched version immediately. Depending on your operating system, you can use the following commands:

 

For Debian-based systems:

 

        sudo apt update
        sudo apt install postgresql-13

 

Replace "postgresql-13" with the version you are upgrading to, such as "postgresql-14" for version 14.16.

 

For Red Hat-based systems:

 

        sudo yum check-update
        sudo yum install postgresql

 

Again, specify the correct package name based on your PostgreSQL version.

 

For systems using Homebrew:

 

        brew update
        brew upgrade postgresql

 

After the Upgrade

After upgrading, restart your PostgreSQL service to ensure all changes are applied effectively:

 

        sudo systemctl restart postgresql

 

Conclusion

The discovery and patching of CVE-2025-1094 underscore the critical importance of maintaining up-to-date software to mitigate potential cyber threats. System administrators and users should apply the patches immediately to protect against exploits that could lead to unauthorized system access or data breaches. Furthermore, organizations using BeyondTrust products should ensure that those systems are also updated to guard against the CVE-2024-12356 exploit.

 

If you want to immediately be warned of similar vulnerabilities affecting your system then use BaseFortify.eu and its Attack Surface Management (ASM functionality. By entering a list of installed applications & libraries a match will automatically be made in the future and you will receive a warning immediately. By registering for free you will unlock our in-depth CVE annotations and A.I. Assistant. Both use data found in links associated with a CVE report so there is no need to read those yourself.

 

Sources: Debian.org, HackerNews & PostgreSQL.org