{"id":121960,"date":"2025-02-16T20:22:05","date_gmt":"2025-02-16T18:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust"},"modified":"2025-02-16T20:22:05","modified_gmt":"2025-02-16T18:22:05","slug":"v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","title":{"rendered":"PostgreSQL ir nov\u0113rsta ievainojam\u012bba, ko izmantoja uzbrukumam BeyondTrust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ir izstr\u0101d\u0101ti labojumu atjaunin\u0101jumi vis\u0101m atbalst\u012btaj\u0101m PostgreSQL versij\u0101m 17.3, 16.7, 15.11, 14.16 un 13.19, kuros ir nov\u0113rstas vair\u0101k nek\u0101 70 k\u013c\u016bdas un iz labota ievainojam\u012bba (CVE-2025-1094), kas tika izmantota uzbrukum\u0101 pret uz\u0146\u0113mumu BeyondTrust un ASV Finan\u0161u ministriju beig\u0101s decembra. Probl\u0113ma PostgreSQL tika identific\u0113ta, analiz\u0113jot att\u0101lin\u0101tu ievainojam\u012bbu (CVE-2024-12356) pakalpojumos BeyondTrust PRA (Privileged Remote Access) un BeyondTrust RS (Remote Support), kuru ekspluat\u0101cij\u0101 papildus tika izmantota iepriek\u0161 nezin\u0101ma (0-day) ievainojam\u012bba libpq. <\/p>\n

Uzbrukuma rezult\u0101t\u0101 \u013caundariem izdev\u0101s ieg\u016bt atsl\u0113gu piek\u013cuvei API, ko izmanto, lai att\u0101lin\u0101ti nodro\u0161in\u0101tu tehnisko atbalstu BeyondTrust SaaS pakalpojumu klientiem. \u0160is API tika izmantots, lai atiestat\u012btu paroli un apdraud\u0113tu ASV Finan\u0161u ministrijas infrastrukt\u016bru, kas izmanto BeyondTrust produktus. Uzbrukuma laik\u0101 \u013caundariem izdev\u0101s aug\u0161upiel\u0101d\u0113t konfidenci\u0101lus dokumentus un ieg\u016bt piek\u013cuvi ministrijas darbinieku darba stacij\u0101m. <\/p>\n

Ievainojam\u012bba izpau\u017eas libpq bibliot\u0113k\u0101, kas nodro\u0161ina API datub\u0101zu saskarnei no C valod\u0101 rakst\u012btiem programmat\u016bras risin\u0101jumiem (virs \u0161\u012bs bibliot\u0113kas ir izstr\u0101d\u0101tas ar\u012b C++, Perl, PHP un Python valod\u0101m piel\u0101gotas bibliot\u0113kas). Probl\u0113ma skar lietojumprogrammas, kas izmanto funkcijas PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() vai PQescapeStringConn() speci\u0101lo simbolu un p\u0113di\u0146u izb\u0113g\u0161anai. <\/p>\n

Uzbruc\u0113js var pan\u0101kt sava SQL koda ievieto\u0161anu, ja \u0101r\u0113ji ieg\u016btais teksts tiek izb\u0113gts pirms t\u0101 izmanto\u0161anas SQL vaic\u0101jum\u0101 ar iepriek\u0161 min\u0113taj\u0101m libpq funkcij\u0101m. BeyondTrust lietojumprogramm\u0101s t\u0101d\u0101 veid\u0101 izb\u0113gtie vaic\u0101jumi tika nodoti caur komandu rindu util\u012btu psql. Ievainojam\u012bba ir radusies, jo funkciju izb\u0113g\u0161anai tr\u016bkst p\u0101rbaudes par izmantotajos tekst\u0101 eso\u0161ajiem Unicode simboliem, kas \u013cauj apiet p\u0113di\u0146u normaliz\u0101ciju, izmantojot nepareizas UTF-8 daudzbitu sec\u012bbas. <\/p>\n

Ekspluat\u0101cijai var izmantot nepareizu UTF-8 simbolu, kas sast\u0101v no baitiem 0xC0 un 0x27 («\u2514'»). Baits 0x27 ASCII kod\u0113 atbilst vienk\u0101r\u0161ai p\u0113di\u0146ai («‘»), kas j\u0101noblo\u0137\u0113. Blo\u0137\u0113\u0161anas kod\u0101 baitu kombin\u0101cija 0xC0 un 0x27 tiek apstr\u0101d\u0101ta k\u0101 viens Unicode simbols. Attiec\u012bgi, baits 0x27 \u0161\u0101d\u0101 sec\u012bb\u0101 paliek neblokuots, savuk\u0101rt, apstr\u0101d\u0101jot SQL vaic\u0101jumu util\u012bt\u0113 psql, tas tiek apstr\u0101d\u0101ts k\u0101 p\u0113di\u0146a. <\/p>\n

Veicot SQL piepras\u012bjumu izpilde<\/a> Ar util\u012btas psql pal\u012bdz\u012bbu, lai organiz\u0113tu patva\u013c\u012bga koda izpildi, var izmantot aizvieto\u0161anu komand\u0101 «\!», kas psql ir paredz\u0113ta patva\u013c\u012bgu programmu palai\u0161anai. Piem\u0113ram, lai palaistu uz serveri<\/a> util\u012btas «id» var nodot v\u0113rt\u012bbu «hax\xC0′; \! id #». T\u0101l\u0101k redzamaj\u0101 piem\u0113r\u0101, lai noblo\u0137\u0113tu, tiek izsaukts PHP skripts dbquote, kas izmanto PHP funkciju pg_escape_string, kas str\u0101d\u0101 virs PQescapeString funkcijas no libpq: $ echo -e «hello \xC0’world'» | .\\\/dbquote ‘hello \u2514’world»’ $ quoted=$(echo -e «hax\xC0′; \! id # » | .\\\/dbquote) $ echo «SELECT COUNT(1) FROM gw_sessions WHERE session_key = $quoted AND session_type = ‘sdcust’ AND (expiration IS NULL OR expiration>NOW())» | psql -e SELECT COUNT(1) FROM gw_sessions WHERE session_key = ‘hax\u2514’; ERROR: neder\u012bga baitu sec\u012bba kod\u0113\u0161anai «UTF8»: 0xc0 0x27 uid=1000(myexamplecompany) gid=1000(myexamplecompany)
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e BeyondTrust \u0438 \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0421\u0428\u0410. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PostgreSQL \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-12356) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 BeyondTrust PRA (Privileged Remote Access) \u0438 BeyondTrust […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121960","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PostgreSQL nov\u0113rsta ievainojam\u012bba, kas tika izmantota uzbrukum\u0101 pret BeyondTrust | ProHoster","description":"Ir izstr\u0101d\u0101tas korekt\u012bv\u0101s atjaunin\u0101\u0161anas vis\u0101m atbalst\u012btaj\u0101m PostgreSQL versij\u0101m 17.3, 16.7, 15.11, 14.16 un 13.19, kur\u0101s ir nov\u0113rstas vair\u0101k nek\u0101 70 k\u013c\u016bdas un iepriek\u0161min\u0113t\u0101 ievainojam\u012bba (CVE-2025-1094) tika nov\u0113rsta decembra beig\u0101s.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PostgreSQL \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 BeyondTrust | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-16T18:22:05+00:00","article:modified_time":"2025-02-16T18:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121960","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:39:20","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/121960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=121960"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/121960\/revisions"}],"predecessor-version":[{"id":160023,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/121960\/revisions\/160023"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=121960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=121960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=121960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}