Bug 2228111 (CVE-2023-39417)

Summary: CVE-2023-39417 postgresql: extension script @substitutions@ within quoting allow SQL injection
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, caswilli, fjansen, fjanus, hhorak, hkataria, jburrell, jorton, kaycoth, kshier, nweather, pkubat, praiskup, psegedy, security-response-team, stcannon, tsasak, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: postgresql 11.21, postgresql 12.16, postgresql 13.12, postgresql 14.9, postgresql 15.4 Doc Type: If docs needed, set a value
Doc Text:
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2228115, 2228116, 2228117, 2228118, 2228119, 2228120, 2228121, 2231245, 2231246    
Bug Blocks: 2228105    

Description TEJ RATHI 2023-08-01 12:31:50 UTC 
An extension script is vulnerable if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or "").  No bundled extension is vulnerable.  Vulnerable uses do appear in a documentation example and in non-bundled extensions.  Hence, the attack prerequisite is an administrator having installed files of a vulnerable, trusted, non-bundled extension. Subject to that prerequisite, this enables an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. PostgreSQL will block this attack in the core server, so there's no need to modify individual extensions.

Supported, Vulnerable Versions: 11 - 15.
Comment 4 TEJ RATHI 2023-08-11 06:00:30 UTC 
This CVE is now public - https://www.postgresql.org/support/security/CVE-2023-39417