aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path

CVE-2023-32305

What is CVE-2023-32305?

The aiven-extras PostgreSQL extension prior to version 1.1.9 is susceptible to a privilege escalation vulnerability. This issue stems from missing schema qualifiers on privileged functions called by the extension. A low-privileged user can create objects that override existing function names, leading to the execution of those functions with escalated privileges. By exploiting this flaw, a low-privileged user could gain 'superuser' access within PostgreSQL databases utilizing aiven-extras, allowing unrestricted access to all data and capabilities within the database. This breach may also pave the way for arbitrary code execution or unauthorized data access as the 'postgres' user. Users are strongly advised to upgrade to version 1.1.9 or later to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References