aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser inside PostgreSQL databases during a migration from an untrusted source server. By exploiting a lack of search_path restriction, an attacker can override pg_catalog and execute untrusted operators as a superuser. This vulnerability is fixed in 1.0.7.
The vulnerability results from the lack of restrictions on the search_path variable during the database migration process. An attacker controlling the source server can overwrite the system pg_catalog schema with their own objects, including operators. As a result, PostgreSQL executes substituted, untrusted operators in the context of superuser privileges, which is a classic case of path traversal in SQL schema space (CWE-22).
An attacker can escalate their privileges to the PostgreSQL superuser level, giving them full control over the target database — the ability to read and modify all data, execute arbitrary commands at the database level, and potentially further compromise the environment.
Update aiven-db-migrate to version 1.0.7 or later, in which the vulnerability has been fixed. The patch is available in the vendor's GitHub repository (commit 39517dc55720055d93262033b142a365f5bf92c5). Until the update is applied, avoid performing migrations from untrusted source servers.
Aiven aiven-db-migrate tool in versions earlier than 1.0.7, used for data migration to PostgreSQL databases from untrusted source servers.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HAiven Db Migrate
APPAiven< 1.0.7
Related vulnerabilities
Privilege escalation do superuser w Aiven-Db-Migrate przez złośliwy dump PostgreSQL
Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal. Prior to 2.10.2, there is an impr...
MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to...
aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, ...
Aiven Operator umożliwia udostępnianie i zarządzanie usługami Aiven z klastra Kubernetes. W wersjach od 0.31.0...