{"id":121960,"date":"2025-02-16T20:22:05","date_gmt":"2025-02-16T18:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust"},"modified":"2025-02-16T20:22:05","modified_gmt":"2025-02-16T18:22:05","slug":"v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","title":{"rendered":"Une vuln\u00e9rabilit\u00e9 dans PostgreSQL a \u00e9t\u00e9 corrig\u00e9e, utilis\u00e9e lors de l'attaque contre BeyondTrust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des mises \u00e0 jour correctives ont \u00e9t\u00e9 \u00e9mises pour toutes les versions prises en charge de PostgreSQL 17.3, 16.7, 15.11, 14.16 et 13.19, corrigeant plus de 70 bogues et \u00e9liminant une vuln\u00e9rabilit\u00e9 (CVE-2025-1094) qui, fin d\u00e9cembre, a \u00e9t\u00e9 exploit\u00e9e dans une attaque contre la soci\u00e9t\u00e9 BeyondTrust et le minist\u00e8re des Finances des \u00c9tats-Unis. Le probl\u00e8me dans PostgreSQL a \u00e9t\u00e9 identifi\u00e9 lors de l'analyse d'une vuln\u00e9rabilit\u00e9 \u00e0 distance (CVE-2024-12356) dans les services BeyondTrust PRA (Privileged Remote Access) et BeyondTrust RS (Remote Support), dont l'exploitation a \u00e9galement impliqu\u00e9 une vuln\u00e9rabilit\u00e9 auparavant inconnue (0-day) dans libpq. <\/p>\n

\u00c0 la suite de l'attaque, les cybercriminels ont r\u00e9ussi \u00e0 obtenir une cl\u00e9 d'acc\u00e8s \u00e0 l'API utilis\u00e9e pour fournir un support technique \u00e0 distance aux clients des services SaaS de BeyondTrust. Cette API a \u00e9t\u00e9 utilis\u00e9e pour r\u00e9initialiser le mot de passe et compromettre l'infrastructure du minist\u00e8re des Finances des \u00c9tats-Unis, qui utilise des produits BeyondTrust. Au cours de l'attaque, les cybercriminels ont pu t\u00e9l\u00e9charger des documents confidentiels et acc\u00e9der aux stations de travail des employ\u00e9s du minist\u00e8re. <\/p>\n

La vuln\u00e9rabilit\u00e9 se manifeste dans la biblioth\u00e8que libpq, qui fournit une API pour interagir avec les bases de donn\u00e9es depuis des programmes en langage C (des biblioth\u00e8ques de liaison pour C++, Perl, PHP et Python sont \u00e9galement impl\u00e9ment\u00e9es sur cette biblioth\u00e8que). Le probl\u00e8me concerne les applications qui utilisent les fonctions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() ou PQescapeStringConn() pour \u00e9chapper les caract\u00e8res sp\u00e9ciaux et neutraliser les guillemets. <\/p>\n

Un attaquant peut parvenir \u00e0 injecter son propre code SQL si le texte re\u00e7u de l'ext\u00e9rieur est \u00e9chapp\u00e9 \u00e0 l'aide des fonctions libpq mentionn\u00e9es ci-dessus avant d'\u00eatre utilis\u00e9 dans une requ\u00eate SQL. Dans les applications de BeyondTrust, les requ\u00eates ainsi \u00e9chapp\u00e9es \u00e9taient transmises via l'utilitaire de ligne de commande psql. La vuln\u00e9rabilit\u00e9 est caus\u00e9e par l'absence de v\u00e9rification de la validit\u00e9 des caract\u00e8res Unicode utilis\u00e9s dans le texte dans les fonctions d'\u00e9chappement, ce qui permet de contourner la normalisation des guillemets en sp\u00e9cifiant des s\u00e9quences multi-octets UTF-8 incorrectes. <\/p>\n

Pour exploiter cette vuln\u00e9rabilit\u00e9, un symbole UTF-8 incorrect peut \u00eatre utilis\u00e9, compos\u00e9 des octets 0xC0 et 0x27 («\u2514'»). L'octet 0x27 en codage ASCII correspond \u00e0 une apostrophe («‘»), qui doit \u00eatre \u00e9chapp\u00e9e. Dans le code d'\u00e9chappement, la combinaison d'octets 0xC0 et 0x27 est trait\u00e9e comme un seul symbole Unicode. Par cons\u00e9quent, l'octet 0x27 dans cette s\u00e9quence reste non \u00e9chapp\u00e9, m\u00eame si lors du traitement d'une requ\u00eate SQL dans l'outil psql, il est consid\u00e9r\u00e9 comme une apostrophe. <\/p>\n

En cas lancement de requ\u00eates SQL<\/a> \u00c0 l'aide de l'outil psql, pour organiser l'ex\u00e9cution de code arbitraire, vous pouvez utiliser la substitution dans la cha\u00eene de commande «\!», qui est destin\u00e9e dans psql \u00e0 ex\u00e9cuter des programmes arbitraires. Par exemple, pour lancer sur le serveur<\/a> l'outil «id», vous pouvez transmettre la valeur «hax\xC0′; \! id #». Dans l'exemple ci-dessous, pour l'\u00e9chappement, un script PHP appel\u00e9 dbquote est utilis\u00e9, qui utilise la fonction PHP pg_escape_string, fonctionnant au-dessus de la fonction PQescapeString de libpq: $ echo -e «hello \xC0’world'» | .\\\/dbquote ‘hello \u2514’world»’ $ quoted=$(echo -e «hax\xC0′; \! id # » | .\\\/dbquote) $ echo «SELECT COUNT(1) FROM gw_sessions WHERE session_key = $quoted AND session_type = ‘sdcust’ AND (expiration IS NULL OR expiration>NOW())» | psql -e SELECT COUNT(1) FROM gw_sessions WHERE session_key = ‘hax\u2514’; ERROR: s\u00e9quence d'octets invalide pour le codage «UTF8»: 0xc0 0x27 uid=1000(myexamplecompany) gid=1000(myexamplecompany)
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e BeyondTrust \u0438 \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0421\u0428\u0410. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PostgreSQL \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-12356) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 BeyondTrust PRA (Privileged Remote Access) \u0438 BeyondTrust […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121960","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Une vuln\u00e9rabilit\u00e9 dans PostgreSQL a \u00e9t\u00e9 corrig\u00e9e, utilis\u00e9e lors de l'attaque contre BeyondTrust | ProHoster","description":"Des mises \u00e0 jour correctives ont \u00e9t\u00e9 form\u00e9es pour toutes les branches prises en charge PostgreSQL 17.3, 16.7, 15.11, 14.16 et 13.19, dans lesquelles plus de 70 erreurs ont \u00e9t\u00e9 corrig\u00e9es et une vuln\u00e9rabilit\u00e9 (CVE-2025-1094) a \u00e9t\u00e9 \u00e9limin\u00e9e, fin d\u00e9cembre.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PostgreSQL \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 BeyondTrust | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-16T18:22:05+00:00","article:modified_time":"2025-02-16T18:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121960","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:39:20","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=121960"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121960\/revisions"}],"predecessor-version":[{"id":160023,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/121960\/revisions\/160023"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=121960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=121960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=121960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}