SQL Injection Affecting org.postgresql:postgresql package, versions [,42.2.26) [42.3.0,42.4.1)


0.0
high
  • Exploit Maturity

    Proof of concept

  • Attack Complexity

    High

  • User Interaction

    Required

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id

    SNYK-JAVA-ORGPOSTGRESQL-2970521

  • published

    4 Aug 2022

  • disclosed

    4 Aug 2022

  • credit

    kato sho

How to fix?

Upgrade org.postgresql:postgresql to version 42.2.26, 42.4.1 or higher.

Overview

org.postgresql:postgresql is a Java JDBC 4.2 (JRE 8+) driver for PostgreSQL database.

Affected versions of this package are vulnerable to SQL Injection via the java.sql.ResultRow.refreshRow() function in jdbc/PgResultSet.java, due to insufficient escaping column names. An attacker with control of the underlying database can name a column with a string containing a semicolon or other statement terminator, then convince a user to run a query against the table with the compromised column, and then have the application run ResultSet.refreshRow(), to execute code.

NOTE:

  • An application that only connects to its own database with a fixed schema with no DDL permissions is not affected by this vulnerability.
  • Additionally, applications that do not invoke ResultSet.refreshRow() are not affected.

PoC:

CREATE TABLE refresh_row_example (
  id     int PRIMARY KEY,
  "1 FROM refresh_row_example; SELECT pg_sleep(10); SELECT * " int
);

References