CVE-2021-41558
📋 TL;DR
CVE-2021-41558 is a critical vulnerability in the set_user extension for PostgreSQL that allows attackers to bypass ProcessUtility_hook security controls via the set_config function. This affects PostgreSQL databases using set_user extension versions before 3.0.0. Attackers could potentially execute arbitrary SQL commands with elevated privileges.
💻 Affected Systems
- PostgreSQL set_user extension
📦 What is this software?
Set User by Set User Project
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise allowing data theft, modification, or destruction, and potential privilege escalation to database superuser or operating system access.
Likely Case
Unauthorized data access, privilege escalation within the database, and bypass of security controls implemented through ProcessUtility_hook.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and additional security layers are in place.
🎯 Exploit Status
Exploitation requires database access credentials, but the bypass technique is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.0 and later
Vendor Advisory: https://github.com/pgaudit/set_user/releases/tag/REL3_0_0
Restart Required: Yes
Instructions:
1. Backup your database. 2. Download set_user extension version 3.0.0 or later from GitHub. 3. Replace the existing set_user extension files. 4. Restart PostgreSQL service. 5. Verify the extension version with 'SELECT * FROM pg_available_extensions WHERE name = 'set_user';'
🔧 Temporary Workarounds
Disable set_user extension
allTemporarily disable the vulnerable extension until patching is possible
DROP EXTENSION IF EXISTS set_user;
Restrict database access
allLimit database connections to only trusted sources and users
# Configure pg_hba.conf to restrict access
# Example: host all all 192.168.1.0/24 md5
🧯 If You Can't Patch
- Implement strict network access controls to limit database connections
- Apply principle of least privilege to all database user accounts
🔍 How to Verify
Check if Vulnerable:
Connect to PostgreSQL and run: SELECT * FROM pg_available_extensions WHERE name = 'set_user' AND installed_version < '3.0.0';Check Version:
SELECT * FROM pg_available_extensions WHERE name = 'set_user';Verify Fix Applied:
Run: SELECT * FROM pg_available_extensions WHERE name = 'set_user' AND installed_version >= '3.0.0';📡 Detection & Monitoring
Log Indicators:
- Unusual set_config function calls
- Privilege escalation attempts
- Unexpected ProcessUtility_hook bypass events
Network Indicators:
- Unusual database connection patterns
- SQL injection attempts targeting set_user functions
SIEM Query:
SELECT * FROM postgres_logs WHERE message LIKE '%set_user%' OR message LIKE '%set_config%' AND severity IN ('ERROR', 'FATAL')