Arbitrary SQL Execution in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL
Summary
CVE-2024-0985: Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. Affects postgresql13 versions < 13.14-r0. Fixed in 13.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards. It provides various features, including materialized views, which allow users to store the results of a query as a physical table for improved performance. However, a vulnerability has been discovered in the REFRESH MATERIALIZED VIEW CONCURRENTLY command, which is used to refresh materialized views without locking the view for concurrent reads. This vulnerability allows an object creator to execute arbitrary SQL functions as the command issuer, potentially leading to unauthorized access or data manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2024-0985, arises from a late privilege drop in the REFRESH MATERIALIZED VIEW CONCURRENTLY command in PostgreSQL. This command is designed to run SQL functions as the owner of the materialized view, ensuring safe refresh of untrusted materialized views. However, an attacker can exploit this vulnerability by luring a superuser or a member of one of their roles into running REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of the attack, the attacker creates functions that use CREATE RULE to convert the internally-built temporary table to a view, enabling the execution of arbitrary SQL functions. This vulnerability affects versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18. It's important to note that the only known exploit does not work in PostgreSQL 16 and later versions. To mitigate this vulnerability, PostgreSQL 16.2 introduces additional protections similar to those implemented in older branches.
How To Fix
Minimum fixed version
13.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid running the REFRESH MATERIALIZED VIEW CONCURRENTLY command on materialized views created by untrusted sources. Additionally, it is recommended to review and validate the ownership and permissions of materialized views to minimize the risk of unauthorized SQL function execution.
Conclusion
The vulnerability in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer, potentially leading to unauthorized access or data manipulation. It is crucial to update PostgreSQL to version 15.6, 14.11, 13.14, or 12.18, depending on the currently installed version, to mitigate this vulnerability. Regularly updating to the latest stable release is recommended to ensure the availability of security fixes and enhancements. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for postgresql13 →
FAQ
The REFRESH MATERIALIZED VIEW CONCURRENTLY command in PostgreSQL is used to refresh materialized views without locking the view for concurrent reads. It allows users to update the data in a materialized view while still allowing other queries to access the view.
This vulnerability affects PostgreSQL versions before 15.6, 14.11, 13.14, and 12.18. Specifically, it impacts superusers or members of roles created by the attacker who are lured into running the REFRESH MATERIALIZED VIEW CONCURRENTLY command on the attacker's materialized view.
No, the only known exploit for this vulnerability does not work in PostgreSQL 16 and later versions. However, it is still recommended to update to the latest stable release to benefit from additional security measures.
Yes, PostgreSQL 16.2 introduces protections similar to those implemented in older branches to address this vulnerability. It is crucial to update to this version or any subsequent release that includes the necessary patches.
Yes, you can use the Vulert Playground at Vulert Scanner to check if your PostgreSQL installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, allowing you to assess your system's security without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql13.
