SQL Injection Vulnerability in PostgreSQL Anonymizer v1.2 Leads to Privilege Escalation
CVE-2024-2338

7.5HIGH

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
8 March 2024

What is CVE-2024-2338?

PostgreSQL Anonymizer v1.2 contains a SQL injection vulnerability that can be exploited by users who own a table when dynamic masking is enabled. This flaw arises from the improper handling of complex expressions provided as masking values, which can be exploited to create masked views that inadvertently allow SQL injection. As a result, an attacker could elevate their privileges to superuser status if dynamic masking is in use. Users without table ownership, particularly masked users, do not have the ability to exploit this vulnerability. The issue has been addressed in version 1.3.

Affected Version(s)

PostgreSQL Anonymizer 1 < 1.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/commit/...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks Pedro Gallegos for reporting this problem.
.