pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.
The vulnerability occurs only when the application is configured with the PreferQueryMode=SIMPLE option (this is not the default mode). In this mode, pgjdbc does not use the parameterized query mechanism on the server side, but performs value substitution on the client side. An attacker can construct a specially crafted payload for a text value if directly before its placeholder there is a numeric value placeholder preceded by a minus sign, and both placeholders are on the same line. Such a construction allows injection of arbitrary SQL code, bypassing the protection provided by parameterized queries.
An attacker can arbitrarily modify executed SQL queries, which may lead to unauthorized reading, modification or deletion of data in the database, and depending on the privileges of the database account — even to takeover of the database system.
Update pgjdbc to version 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9 or 42.2.28 (depending on the branch used). If updating is not immediately possible, ensure that the application does not use PreferQueryMode=SIMPLE mode — the default mode is not vulnerable to this vulnerability.
PostgreSQL JDBC Driver (pgjdbc) in versions prior to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9 and 42.2.28, configured with the PreferQueryMode=SIMPLE option.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HFedora Project Fedora
OSFedoraproject40PostgreSQL Jdbc Driver
APPPostgresql42.3.0 – 42.3.9 (excl.)42.4.0 – 42.4.4 (excl.)< 42.2.2842.6.0 – 42.6.1 (excl.)42.7.0 – 42.7.2 (excl.)42.5.0 – 42.5.5 (excl.)
Related vulnerabilities
PHP CGI argument injection – RCE na Windows przez mechanizm Best-Fit
Type Confusion w V8 (Google Chrome) — RCE przez spreparowaną stronę HTML
Type Confusion w silniku V8 Chrome — zdalne wykonanie kodu (RCE)
Use-after-free w Google Chrome Visuals umożliwiający ucieczkę z sandbox
Integer overflow w Skia w Google Chrome — sandbox escape