Correction updates have been released for all supported branches of PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19, addressing over 70 bugs and fixing a vulnerability (CVE-2025-1094) that was utilized in late December in the attack on BeyondTrust and the U.S. Department of the Treasury. The issue in PostgreSQL was identified during the analysis of a remote vulnerability (CVE-2024-12356) in BeyondTrust PRA (Privileged Remote Access) and BeyondTrust RS (Remote Support) services, where an unknown (0-day) vulnerability in libpq was also exploited.
As a result of the attack, the perpetrators managed to obtain an API key used for remote technical support services to clients of BeyondTrust's SaaS solutions. This API was used to reset passwords and compromise the infrastructure of the U.S. Department of the Treasury, which utilizes BeyondTrust products. During the attack, the attackers were able to download confidential documents and gain access to the workstations of department employees.
The vulnerability manifests in the libpq library, which provides an API for interacting with the database management system from C language programs (binding libraries for C++, Perl, PHP, and Python are also implemented on top of the library). The problem affects applications that use the functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), or PQescapeStringConn() for escaping special characters and neutralizing quotes.
An attacker can achieve the injection of their SQL code if the externally obtained text is escaped using the aforementioned libpq functions before being used in an SQL query. In BeyondTrust applications, queries escaped in this manner were passed through the command-line utility psql. The vulnerability is caused by the lack of correctness checks for Unicode characters used in the text within the escaping functions, which allows bypassing quote normalization by specifying invalid multi-byte UTF-8 sequences.
The vulnerability can be exploited using an incorrect UTF-8 character consisting of the bytes 0xC0 and 0x27 ("└'"). The byte 0x27 in ASCII encoding corresponds to a single quote ("‘"), which needs to be escaped. In the escape code, the byte combination 0xC0 and 0x27 is treated as a single Unicode character. Consequently, the byte 0x27 in this sequence remains unescaped, while it is processed as a quote when handling the SQL request in the psql utility.
Upon executing SQL queries using the psql utility to facilitate the execution of arbitrary code can leverage the substitution in the command string "\!", which is intended in psql for running arbitrary programs. For example, to run server the "id" utility, you can pass the value "hax\xC0′; \! id #". In the example below, a PHP script dbquote is called for escaping, using the PHP function pg_escape_string that works on top of the PQescapeString function from libpq: $ echo -e "hello \xC0’world'" | .\/dbquote ‘hello └’world»’ $ quoted=$(echo -e "hax\xC0′; \! id # " | .\/dbquote) $ echo "SELECT COUNT(1) FROM gw_sessions WHERE session_key = $quoted AND session_type = 'sdcust' AND (expiration IS NULL OR expiration>NOW())" | psql -e SELECT COUNT(1) FROM gw_sessions WHERE session_key = 'hax└'; ERROR: invalid byte sequence for encoding "UTF8": 0xc0 0x27 uid=1000(myexamplecompany) gid=1000(myexamplecompany)
Source: opennet.ru
