Korrigerende oppdateringer er utgitt for alle st\u00f8ttede versjoner av PostgreSQL 17.3, 16.7, 15.11, 14.16 og 13.19, som retter over 70 feil og eliminerer en s\u00e5rbarhet (CVE-2025-1094), som ble utnyttet i slutten av desember i et angrep mot selskapet BeyondTrust og det amerikanske finansdepartementet. Problemet i PostgreSQL ble avdekket ved analyse av en ekstern s\u00e5rbarhet (CVE-2024-12356) i BeyondTrusts PRA (Privileged Remote Access) og RS (Remote Support), hvor utnyttelsen ogs\u00e5 involverte en tidligere ukjent (0-day) s\u00e5rbarhet i libpq. <\/p>\n
Som et resultat av angrepet klarte angriperne \u00e5 f\u00e5 tilgang til API-n\u00f8kkelen som brukes for fjern-teknisk st\u00f8tte til kunder av BeyondTrusts SaaS-tjenester. Dette API-et ble brukt til \u00e5 tilbakestille passordet og kompromittere infrastrukturen til det amerikanske finansdepartementet, som bruker produkter fra BeyondTrust. Under angrepet klarte angriperne \u00e5 laste opp konfidensielle dokumenter og fikk tilgang til arbeidsstasjonene til departementets ansatte. <\/p>\n
S\u00e5rbarheten oppst\u00e5r i biblioteken libpq, som gir et API for interaksjon med databasen fra programmer skrevet i C (det er ogs\u00e5 utviklet bindinger for C++, Perl, PHP og Python over biblioteket). Problemet ber\u00f8rer applikasjoner som bruker funksjonene PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() eller PQescapeStringConn() for \u00e5 skanne spesialtegn og n\u00f8ytralisere anf\u00f8rselstegn. <\/p>\n
Angriperen kan oppn\u00e5 innsetting av sin egen SQL-kode dersom teksten som mottas fra utsiden, blir skannet med de nevnte libpq-funksjonene f\u00f8r den brukes i SQL-sp\u00f8rringer. I BeyondTrust-applikasjoner ble slike skannede sp\u00f8rringer sendt gjennom kommandolinjeverkt\u00f8yet psql. S\u00e5rbarheten skyldes mangel p\u00e5 validering av gyldige Unicode-tegn i skannefunksjonene, noe som tillater omg\u00e5else av normaliseringen av anf\u00f8rselstegn ved \u00e5 spesifisere ugyldige multibyte-sekvenser i UTF-8. <\/p>\n
For exploitation, the vulnerability can utilize an incorrect UTF-8 character consisting of the bytes 0xC0 and 0x27 (\u2514'). Byte 0x27 in ASCII coding corresponds to a single quote ('), which needs to be escaped. In the escape code, the byte combination 0xC0 and 0x27 is processed as one Unicode character. Consequently, byte 0x27 in such a sequence remains unescaped, while processing an SQL query in the psql utility, it is treated as a quote. <\/p>\n
Ved executing SQL queries<\/a> Using the psql utility for organizing the execution of arbitrary code, one can use substitution in the command string \\\\! intended for psql to launch arbitrary programs. For example, to start on serveren<\/a> the utility 'id', one can pass the value 'hax\\xC0\u2032; \\\\! id #. In the example below, a PHP script dbquote is called for escaping, which uses the PHP function pg_escape_string, operating on top of the PQescapeString function from libpq: $ echo -e 'hello \\xC0\u2032world' | .\/dbquote 'hello \u2514\u2032world' $ quoted=$(echo -e 'hax\\xC0\u2032; \\\\! id # ' | .\/dbquote) $ echo 'SELECT COUNT(1) FROM gw_sessions WHERE session_key = $quoted AND session_type = 'sdcust' AND (expiration IS NULL OR expiration>NOW())' | psql -e SELECT COUNT(1) FROM gw_sessions WHERE session_key = 'hax\u2514'; ERROR: invalid byte sequence for encoding 'UTF8': 0xc0 0x27 uid=1000(myexamplecompany) gid=1000(myexamplecompany) \u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e BeyondTrust \u0438 \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0421\u0428\u0410. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PostgreSQL \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-12356) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 BeyondTrust PRA (Privileged Remote Access) \u0438 BeyondTrust […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121960","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47The vulnerability in PostgreSQL, exploited in the attack on BeyondTrust, has been eliminated | ProHoster","description":"Corrective updates have been generated for all supported branches PostgreSQL 17.3, 16.7, 15.11, 14.16 and 13.19, in which more than 70 errors are fixed and the vulnerability (CVE-2025-1094) is eliminated, at the end of December.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PostgreSQL \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 BeyondTrust | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f.","og:url":"https:\/\/prohoster.info\/no\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-16T18:22:05+00:00","article:modified_time":"2025-02-16T18:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121960","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:39:20","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/121960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=121960"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/121960\/revisions"}],"predecessor-version":[{"id":160023,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/121960\/revisions\/160023"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=121960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=121960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=121960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"