Rendered at 23:03:08 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
logophobia 2 hours ago [-]
Correct me if I'm wrong, but those all look like sql exploits. Don't those already require some sort of authenticated remote access. They are security issues, but calling them remote code exploitation make them seem more dangerous than they are.
These seem more like privilege escalation, you have access through a database account and use that to gain full access to the whole server. So an issue for multi-tenant databases mostly.
kccqzy 53 minutes ago [-]
You can do authentication and authorization inside sql. For example you could have something like
CREATE ROLE initial LOGIN NOINHERIT NOCREATEDB NOCREATEROLE NOSUPERUSER;
And then you run SQL to validate any credentials and then check the database for any permissions, ending with
SET LOCAL ROLE someuser;
It is uncommon but some people appreciate the simplicity of making the application layer do as little work as possible while pushing work into the database. It’s the logical conclusion after years of telling developers about the N+1 query problem.
mistrial9 24 minutes ago [-]
that requires additional privelages plus login.. I agree with the pp, sensationalism
vfosnar 2 hours ago [-]
ppl host open Postgres instances, one I can think of is https://postpass.geofabrik.de/ where you can query OpenStreetMap data in a Postgres instance exposed over plain HTTP API
veqq 7 minutes ago [-]
Wow, that is... I would have never believed in such a thing.
knorker 2 hours ago [-]
It's RCE even if it's not pre-auth.
jmuguy 2 hours ago [-]
I would call this more of a privilege escalation attack than RCE.
igbanam 3 hours ago [-]
Thanks for actually sharing your path to the zero-day. The context and story helps
2 hours ago [-]
NeuraCryption 3 hours ago [-]
Is this exploitable? If it is, this is very serious and if this is an unpatched disclosure millions of Businesses around the world will be affected.
mattashii 2 hours ago [-]
Yes, once you have logged in on a primary.
mdaniel 2 hours ago [-]
Isn't that only true if "millions of businesses" choose to hang their PG port out on the Internet with "allow 0/0"? In the spirit of being constructive, https://www.shodan.io/search?query=postgresql shows 516,000 which is definitely not none but pretty far from millions and based on skimming the results pretty far from the businesses part, too
mgiampapa 2 hours ago [-]
I would consider it a more useful lateral movement vector inside an existing org than anything else. Lots and lots of old postgress with weak acls inside networks.
sailfast 2 hours ago [-]
Amazing write-up. A great look at DB internals and your thought process.
These seem more like privilege escalation, you have access through a database account and use that to gain full access to the whole server. So an issue for multi-tenant databases mostly.