{"id":121960,"date":"2025-02-16T20:22:05","date_gmt":"2025-02-16T18:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust"},"modified":"2025-02-16T20:22:05","modified_gmt":"2025-02-16T18:22:05","slug":"v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","title":{"rendered":"Vulnerabilitatea din PostgreSQL utilizat\u0103 \u00een atacul asupra BeyondTrust a fost eliminat\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Au fost formate actualiz\u0103ri corective pentru toate ramurile suportate PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0219i 13.19, \u00een care au fost corectate peste 70 de erori \u0219i a fost eliminat\u0103 o vulnerabilitate (CVE-2025-1094), activat\u0103 la sf\u00e2r\u0219itul lunii decembrie \u00een atacul asupra companiei BeyondTrust \u0219i a Ministerului Finan\u021belor din SUA. Problema \u00een PostgreSQL a fost identificat\u0103 \u00een urma analizei unei vulnerabilit\u0103\u021bi la distan\u021b\u0103 (CVE-2024-12356) \u00een serviciile BeyondTrust PRA (Acces Remote Privilegiat) \u0219i BeyondTrust RS (Suport Remote), exploatarea c\u0103reia a implicat, de asemenea, o vulnerabilitate necunoscut\u0103 anterior (0-day) \u00een libpq. <\/p>\n

Ca rezultat al atacului, atacatorii au reu\u0219it s\u0103 ob\u021bin\u0103 o cheie pentru accesul la API-ul utilizat pentru furnizarea de servicii de suport tehnic clien\u021bilor serviciilor SaaS BeyondTrust. Acest API a fost folosit pentru resetarea parolei \u0219i compromiterea infrastructurii Ministerului Finan\u021belor din SUA, care folose\u0219te produsele BeyondTrust. \u00cen timpul atacului, atacatorii au reu\u0219it s\u0103 \u00eencarce documente confiden\u021biale \u0219i au ob\u021binut acces la sta\u021biile de lucru ale angaja\u021bilor ministerului. <\/p>\n

Vulnerabilitatea se manifest\u0103 \u00een biblioteca libpq, care ofer\u0103 un API pentru interac\u021biunea cu SGBD-uri din programe scrise \u00een limbajul C (deasupra bibliotecii sunt implementate \u0219i biblioteci wrapper pentru C++, Perl, PHP \u0219i Python). Problema afecteaz\u0103 aplica\u021biile care utilizeaz\u0103 func\u021biile PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() sau PQescapeStringConn() pentru a sc\u0103pa caractere speciale \u0219i a neutraliza ghilimelele. <\/p>\n

Atacatorul poate ob\u021bine substitu\u021bia propriului cod SQL dac\u0103 textul primit din exterior este sc\u0103pat folosind func\u021biile de mai sus ale libpq \u00eenainte de utilizarea \u00een interiorul unei interog\u0103ri SQL. \u00cen aplica\u021biile BeyondTrust, interog\u0103rile sc\u0103pate \u00een acest mod au fost transmise prin utilitarul de linie de comand\u0103 psql. Vulnerabilitatea este cauzat\u0103 de lipsa verific\u0103rii validit\u0103\u021bii caracterelor Unicode utilizate \u00een text \u00een func\u021biile de sc\u0103pare, ceea ce permite ocolirea normaliz\u0103rii ghilimelelor prin specificarea unor secven\u021be UTF-8 incorecte. <\/p>\n

Pentru exploatare, vulnerabilitatea poate utiliza un simbol UTF-8 incorect, format din byte-urile 0xC0 \u0219i 0x27 (\u2514'). Byte-ul 0x27 \u00een codificarea ASCII corespunde apostrofului ('), care trebuie evitat. \u00cen codul de evadare, combina\u021bia de byte-uri 0xC0 \u0219i 0x27 este tratat\u0103 ca un singur simbol Unicode. Prin urmare, byte-ul 0x27 \u00een aceast\u0103 secven\u021b\u0103 r\u0103m\u00e2ne neevitat, iar \u00een procesarea interog\u0103rii SQL \u00een utilitarul psql, este tratat ca un apostrof. <\/p>\n

Upon execu\u021bia interog\u0103rilor SQL<\/a> folosind utilitarul psql, pentru a organiza executarea unui cod arbitrar, se poate utiliza substitu\u021bia \u00een linia de comand\u0103 \\\\!, destinat\u0103 \u00een psql pentru a lansa programe arbitrare. De exemplu, pentru a lansa pe server<\/a> utilitarul 'id' se poate transmite valoarea 'hax\\xC0\u2032; \\\\! id #. \u00cen exemplul de mai jos, pentru evadare se apeleaz\u0103 scriptul PHP dbquote, care folose\u0219te func\u021bia PHP pg_escape_string, func\u021bion\u00e2nd pe baza func\u021biei PQescapeString din libpq: $ echo -e 'hello \\xC0\u2019world' | .\/dbquote 'hello \u2514\u2019world' $ quoted=$(echo -e 'hax\\xC0\u2032; \\\\! id # ' | .\/dbquote) $ echo 'SELECT COUNT(1) FROM gw_sessions WHERE session_key = $quoted AND session_type = 'sdcust' AND (expiration IS NULL OR expiration>NOW())' | psql -e SELECT COUNT(1) FROM gw_sessions WHERE session_key = 'hax\u2514'; ERROR: secven\u021b\u0103 de byte invalid\u0103 pentru codificarea 'UTF8': 0xc0 0x27 uid=1000(myexamplecompany) gid=1000(myexamplecompany)
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e BeyondTrust \u0438 \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0421\u0428\u0410. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PostgreSQL \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-12356) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 BeyondTrust PRA (Privileged Remote Access) \u0438 BeyondTrust […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121960","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitatea din PostgreSQL a fost eliminat\u0103, utilizat\u0103 \u00een atacul asupra BeyondTrust | ProHoster","description":"Au fost formulate actualiz\u0103ri corective pentru toate ramurile suportate ale PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0219i 13.19, \u00een care au fost corectate peste 70 de erori \u0219i a fost remediat\u0103 vulnerabilitatea (CVE-2025-1094), la sf\u00e2r\u0219itul lunii decembrie.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PostgreSQL \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 BeyondTrust | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-16T18:22:05+00:00","article:modified_time":"2025-02-16T18:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121960","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:39:20","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/121960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=121960"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/121960\/revisions"}],"predecessor-version":[{"id":160023,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/121960\/revisions\/160023"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=121960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=121960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=121960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}