Login Sign Up

CVE-2021-33204

9.8 CRITICAL
Remote Code Execution

📋 TL;DR

This vulnerability in pg_partman (PostgreSQL Partition Manager) allows arbitrary code execution via SECURITY DEFINER functions that don't set an explicit search_path. Attackers can exploit this to execute malicious SQL commands with elevated privileges. Any PostgreSQL installation using pg_partman extension versions before 4.5.1 is affected.

💻 Affected Systems

Products:
  • pg_partman (PostgreSQL Partition Manager)
Versions: All versions before 4.5.1
Operating Systems: All operating systems running PostgreSQL with pg_partman
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects PostgreSQL installations where pg_partman extension is installed and enabled. The vulnerability exists in SECURITY DEFINER functions within the extension.

📦 What is this software?

Pg Partman by Pgxn

View all CVEs affecting Pg Partman →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full database compromise leading to data theft, data destruction, or complete system takeover via privilege escalation to database superuser.

🟠

Likely Case

Unauthorized data access, privilege escalation within the database, and potential lateral movement to other systems.

🟢

If Mitigated

Limited impact if proper network segmentation and least privilege database access controls are implemented.

🌐 Internet-Facing: HIGH if PostgreSQL with pg_partman is exposed to the internet, as this enables remote code execution.
🏢 Internal Only: MEDIUM to HIGH depending on internal network segmentation and user access controls.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires database access (authenticated user). The vulnerability is in SECURITY DEFINER functions which execute with elevated privileges when called by lower-privileged users.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.5.1

Vendor Advisory: https://github.com/pgpartman/pg_partman/commit/0b6565ad378c358f8a6cd1d48ddc482eb7f854d3

Restart Required: No

Instructions:

1. Update pg_partman to version 4.5.1 or later. 2. Run: ALTER EXTENSION pg_partman UPDATE TO '4.5.1'; 3. Verify the update completed successfully.

🔧 Temporary Workarounds

Revoke execute permissions on vulnerable functions

all

Temporarily remove execute permissions from non-superusers on pg_partman's SECURITY DEFINER functions

REVOKE EXECUTE ON FUNCTION function_name FROM public;
REVOKE EXECUTE ON FUNCTION function_name FROM [specific_users];

Set explicit search_path

all

Modify vulnerable functions to include SET search_path = pg_catalog

ALTER FUNCTION function_name SET search_path = pg_catalog;

🧯 If You Can't Patch

  • Implement strict database user access controls and principle of least privilege
  • Network segment PostgreSQL databases and restrict access to trusted sources only

🔍 How to Verify

Check if Vulnerable:

Check pg_partman version: SELECT * FROM pg_available_extensions WHERE name = 'pg_partman'; If version < 4.5.1, system is vulnerable.

Check Version:

SELECT * FROM pg_available_extensions WHERE name = 'pg_partman';

Verify Fix Applied:

Verify pg_partman version is 4.5.1 or later: SELECT * FROM pg_available_extensions WHERE name = 'pg_partman';

📡 Detection & Monitoring

Log Indicators:

  • Unusual database function calls to pg_partman functions
  • Privilege escalation attempts in PostgreSQL logs
  • Unexpected SECURITY DEFINER function executions

Network Indicators:

  • Unusual database connection patterns to PostgreSQL instances with pg_partman

SIEM Query:

source="postgresql" AND ("pg_partman" OR "SECURITY DEFINER") AND (privilege_escalation OR unauthorized_access)

📊 Metadata

CVE ID: CVE-2021-33204
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: May 19, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON