{"id":121960,"date":"2025-02-16T20:22:05","date_gmt":"2025-02-16T18:22:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust"},"modified":"2025-02-16T20:22:05","modified_gmt":"2025-02-16T18:22:05","slug":"v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","title":{"rendered":"V PostgreSQL je bila odpravljena ranljivost, ki je bila izkori\u0161\u010dena pri napadu na BeyondTrust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ustvarjene so bile korekcijske posodobitve za vse podprte razli\u010dice PostgreSQL 17.3, 16.7, 15.11, 14.16 in 13.19, ki odpravljajo ve\u010d kot 70 napak in odpravljajo ranljivost (CVE-2025-1094), ki je bila konec decembra vklju\u010dena v napad na podjetje BeyondTrust in ameri\u0161ko ministrstvo za finance. Te\u017eava v PostgreSQL je bila odkrita pri analizi oddalne ranljivosti (CVE-2024-12356) v storitvah BeyondTrust PRA (Privileged Remote Access) in BeyondTrust RS (Remote Support), pri \u010demer je bila dodatno izkori\u0161\u010dena prej nepoznana (0-day) ranljivost v libpq. <\/p>\n

Zaradi napada so napadalci uspeli pridobiti klju\u010de za dostop do API-ja, ki se uporablja za oddaljeno nudenje tehni\u010dne podpore uporabnikom SaaS storitev podjetja BeyondTrust. Ta API je bil uporabljen za ponastavitev gesla in kompromitacijo infrastrukture ameri\u0161kega ministrstva za finance, ki uporablja proizvode BeyondTrust. Med napadom so napadalci uspeli prenesti zaupne dokumente in pridobili dostop do delovnih postaj zaposlenih ministrstva. <\/p>\n

Ranljivost se pojavi v knji\u017enici libpq, ki zagotavlja API za interakcijo z DBMS iz programov v jeziku C (nad knji\u017enico so implementirane tudi ovitki za C++, Perl, PHP in Python). Te\u017eava vpliva na aplikacije, ki za escaping posebnih znakov in nevtralizacijo narekovajev uporabljajo funkcije PQescapeLiteral(), PQescapeIdentifier(), PQescapeString() ali PQescapeStringConn(). <\/p>\n

Napadalec lahko dose\u017ee vstavljanje svojega SQL koda, \u010de se besedilo, prej pridobljeno od zunaj, pred uporabo v SQL poizvedbi eskapira z zgoraj omenjenimi funkcijami libpq. V aplikacijah podjetja BeyondTrust so bila tako eskapirana vpra\u0161anja posredovana preko ukazne vrstice psql. Ranljivost je posledica pomanjkanja preverjanja pravilnosti uporabljenih Unicode simbolov v besedilu v funkcijah za escaping, kar omogo\u010da obhod normalizacije narekovajev z navedbo neveljavnih ve\u010dbytnih zaporedij UTF-8. <\/p>\n

Za izkori\u0161\u010danje ranljivosti lahko uporabimo neustrezni UTF-8 znak, sestavljen iz bajtov 0xC0 in 0x27 (\u201a\u2514'\u201a). Bajt 0x27 v ASCII kodiranju ustreza enojni navednici (\u201a\u2018\u201a), ki jo je potrebno ube\u017eati. V kodi za ube\u017eanje se zaporedje bajtov 0xC0 in 0x27 obravnava kot en Unicode znak. Glede na to bajt 0x27 v takem zaporedju ostane neubegel, medtem ko se pri obdelavi SQL poizvedbe v orodju psql obravnava kot navednica. <\/p>\n

Pri pokretanju SQL upita<\/a> S pomo\u010djo orodja psql za organizacijo izvajanja poljubne kode lahko uporabimo zamenjavo v nizu ukaza \u201a!\u2018, ki je namenjena za zagon poljubnih programov v psql. Na primer, za zagon na stre\u017enikom<\/a> orodje \u201aid\u2018 lahko predamo vrednost \u201ahax0\u2032; \u201a! id #\u201a. V spodnjem primeru za ube\u017eanje kli\u010demo PHP skripto dbquote, ki uporablja PHP funkcijo pg_escape_string, ki deluje nad funkcijo PQescapeString iz libpq: $ echo -e \u201ahello 0\u2019world'\u201a | .\/dbquote \u201ahello \u2514\u2019world\u201a $ quoted=$(echo -e \u201ahax0\u2032; \u201a! id # \u201a | .\/dbquote) $ echo \u201aSELECT COUNT(1) FROM gw_sessions WHERE session_key = $quoted AND session_type = \u201asdcust\u2018 AND (expiration IS NULL OR expiration>NOW())\u201a | psql -e SELECT COUNT(1) FROM gw_sessions WHERE session_key = \u201ahax\u2514'; ERROR: neveljavna bajtna zaporedja za kodiranje \u201aUTF8\u2018: 0xc0 0x27 uid=1000(myexamplecompany) gid=1000(myexamplecompany)
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0432 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e BeyondTrust \u0438 \u041c\u0438\u043d\u0438\u0441\u0442\u0435\u0440\u0441\u0442\u0432\u043e \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432 \u0421\u0428\u0410. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 PostgreSQL \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043f\u0440\u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2024-12356) \u0432 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445 BeyondTrust PRA (Privileged Remote Access) \u0438 BeyondTrust […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121960","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47U PostgreSQL je eliminisana ranjivost kori\u0161\u0107ena u napadu na BeyondTrust | ProHoster","description":"Formirane su korektivne nadogradnje za sve podr\u017eane grane PostgreSQL 17.3, 16.7, 15.11, 14.16 i 13.19, u kojima je ispravljeno vi\u0161e od 70 gre\u0161aka i eliminisana ranjivost (CVE-2025-1094), krajem decembra.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PostgreSQL \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u0438 \u0430\u0442\u0430\u043a\u0435 \u043d\u0430 BeyondTrust | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0432\u0435\u0442\u043e\u043a PostgreSQL 17.3, 16.7, 15.11, 14.16 \u0438 13.19, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0431\u043e\u043b\u0435\u0435 70 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-1094), \u0432 \u043a\u043e\u043d\u0446\u0435 \u0434\u0435\u043a\u0430\u0431\u0440\u044f.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/v-postgresql-ustranena-uyazvimost-ispolzovannaya-pri-atake-na-beyondtrust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-16T18:22:05+00:00","article:modified_time":"2025-02-16T18:22:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121960","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 22:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:39:20","updated":"2026-02-09 22:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/121960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=121960"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/121960\/revisions"}],"predecessor-version":[{"id":160023,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/121960\/revisions\/160023"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=121960"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=121960"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=121960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}