Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-9193

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

Published

2019-04-01T21:30:45.110

Last Modified

2024-11-21T04:51:10.670

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 7.2 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-78

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	postgresql	postgresql	≤ 11.2	Yes

References

http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html ([email protected])
http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html ([email protected])
https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/ Third Party Advisory ([email protected])
https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5 Exploit, Third Party Advisory ([email protected])
https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/ Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20190502-0003/ Third Party Advisory ([email protected])
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/ Third Party Advisory ([email protected])
http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html (af854a3a-2127-422b-91ae-364da2661108)
https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20190502-0003/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)