Arbitrary File Write Vulnerability in libpgjava Package
Summary
CVE-2022-26520: In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. Affects libpgjava across 2 version ranges.
>= 6d93eb817f334b383d2c8716a50d8c1255e24236, < 9effea487dca529dc5cb0e71600a8c6509819c56
< 42.2.15-1+deb11u1
Fixed in 42.2.15-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libpgjava is a JDBC driver for PostgreSQL that allows Java applications to connect to PostgreSQL databases. It provides a set of functionalities for executing SQL commands and managing database connections. However, it has been identified to have a vulnerability that allows attackers to manipulate connection properties, leading to potential security risks.
Vulnerability Detail
In pgjdbc versions prior to 42.3.3, an attacker who controls the JDBC URL or properties can exploit the loggerFile and loggerLevel connection properties to invoke java.util.logging.FileHandler, enabling them to write to arbitrary files. This could lead to severe consequences, such as creating executable JSP files in a Tomcat web root, thereby compromising the server's integrity. The vendor asserts that the vulnerability lies not within pgjdbc itself but in the usage of untrusted connection properties by applications.
How To Fix
Minimum fixed version
42.2.15-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libpgjavaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted connection properties in your application. Validate and sanitize any input that could influence the JDBC URL or properties to mitigate the risk of exploitation.
Conclusion
The libpgjava package has a critical vulnerability that allows arbitrary file writing through manipulated JDBC connection properties. It is essential to update to the latest versions to safeguard against potential exploits. Additionally, employing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for libpgjava →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to write arbitrary files on the server, potentially leading to unauthorized access or execution of malicious code.
Yes, ensure that you are using libpgjava version 42.2.15-1+deb11u1 for Debian 11, and version 42.3.3-1 or later for Debian 12 and 13 to mitigate this vulnerability.
If an immediate update is not possible, ensure to validate and sanitize any JDBC connection properties to prevent untrusted inputs from being processed.
Related vulnerabilities
Recent vulnerabilities recorded for libpgjava.
