PostgreSQL Terminal Tool Injection Vulnerability Allows Remote Code Execution
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Researchers have uncovered a high-severity SQL injection vulnerability, CVE-2025-1094, affecting PostgreSQL\u2019s interactive terminal tool, psql.\u00a0<\/p>\n
This flaw was identified during research into the exploitation of CVE-2024-12356, a remote code execution (RCE) vulnerability in BeyondTrust Privileged Remote Access (PRA)<\/a> and Remote Support (RS) products.\u00a0<\/p>\n The discovery highlights the interconnected nature of these vulnerabilities, as successful exploitation of CVE-2024-12356 required leveraging CVE-2025-1094 in all tested scenarios.<\/p>\n CVE-2025-1094 arises from an incorrect assumption about the security of escaped untrusted input in PostgreSQL\u2019s string escaping routines.\u00a0<\/p>\n It was believed that properly escaped input could not lead to SQL injection attacks<\/a>. However, when invalid UTF-8 characters are processed by psql, attackers can exploit this flaw to inject malicious SQL statements.\u00a0<\/p>\n This vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity. Attackers can exploit this vulnerability to execute arbitrary SQL statements and achieve arbitrary code execution (ACE) by leveraging psql\u2019s meta-command functionality.\u00a0<\/p>\n Meta-commands, identified by the exclamation mark (!), allow the execution of operating system shell commands directly from the interactive tool.<\/p>\n This vulnerability was found by Stephen Fewer, Principal Security Researcher at Rapid7. CVE-2025-1094 plays a critical role in enabling remote code execution via CVE-2024-12356<\/a>.\u00a0<\/p>\n BeyondTrust patched CVE-2024-12356 in December 2024, blocking its exploitation path and indirectly mitigating attacks involving CVE-2025-1094.\u00a0<\/p>\n However, this patch did not address the root cause of CVE-2025-1094, leaving it as a zero-day vulnerability<\/a> until Rapid7\u2019s disclosure<\/p>\n The vulnerability affects all supported PostgreSQL <\/a>versions prior to 17.3, 16.7, 15.11, 14.16 and 13.19.<\/p>\n The flaw allows attackers to prematurely terminate SQL statements and inject additional commands. <\/p>\n Exploitation can lead to significant risks, including unauthorized database access and full system compromise through shell command execution.<\/p>\n To mitigate CVE-2025-1094, PostgreSQL users should upgrade<\/a> their installations to the latest patched versions:<\/p>\n The PostgreSQL Global Development Group has issued advisories detailing the fixes and providing guidance on security practices.<\/p>\n A Metasploit module targeting CVE-2025-1094 has been developed, enabling exploitation against vulnerable BeyondTrust systems<\/a>. This underscores the urgency for organizations to apply patches promptly.<\/p>\n Organizations using PostgreSQL should act swiftly to patch their systems and review their security protocols to prevent exploitation of such vulnerabilities in the future.<\/p>\n PCI DSS 4.0 & Supply Chain Attack Prevention \u2013\u00a0Free Webinar<\/a><\/strong><\/p>\n The post PostgreSQL Terminal Tool Injection Vulnerability Allows Remote Code Execution<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nPostgreSQL Terminal Tool Injection Vulnerability<\/strong><\/h2>\n
\nMitigation<\/strong>s<\/h2>\n
\n