CVE-2023-23554
📋 TL;DR
This vulnerability in pg_ivm allows attackers to execute arbitrary functions with the privileges of the materialized view owner by exploiting an uncontrolled search path element during IMMV refresh operations. It affects all pg_ivm installations prior to version 1.5.1 where IMMVs are used. Database administrators using pg_ivm for incremental view maintenance are at risk.
💻 Affected Systems
- pg_ivm (PostgreSQL Incremental View Maintenance extension)
📦 What is this software?
Pg Ivm by Sraoss
⚠️ Risk & Real-World Impact
Worst Case
An attacker could execute arbitrary PostgreSQL functions with the privileges of the materialized view owner, potentially leading to privilege escalation, data manipulation, or complete database compromise.
Likely Case
Attackers with database access could execute unauthorized functions to read, modify, or delete data within the database, potentially escalating privileges within the PostgreSQL instance.
If Mitigated
With proper schema permissions and search path controls, the attack surface is reduced, but the vulnerability still exists in the codebase.
🎯 Exploit Status
Exploitation requires database access and knowledge of the target system's schema structure. The attacker needs to create malicious functions in schemas accessible to the vulnerable IMMV refresh operation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.1
Vendor Advisory: https://github.com/sraoss/pg_ivm/releases/tag/v1.5.1
Restart Required: No
Instructions:
1. Download pg_ivm version 1.5.1 from GitHub releases. 2. Stop any applications using pg_ivm IMMVs. 3. Run 'ALTER EXTENSION pg_ivm UPDATE TO '1.5.1';' in PostgreSQL. 4. Verify the update completed successfully. 5. Restart applications using pg_ivm.
🔧 Temporary Workarounds
Restrict Schema Permissions
allLimit CREATE and EXECUTE permissions on schemas accessible to users who might create IMMVs
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA public FROM PUBLIC;
Set Secure Search Path
allConfigure PostgreSQL search_path to exclude untrusted schemas for IMMV owners
ALTER ROLE immv_owner SET search_path = "$user", trusted_schema;
🧯 If You Can't Patch
- Remove or disable pg_ivm extension if not essential
- Audit and restrict all user permissions to create functions in accessible schemas
🔍 How to Verify
Check if Vulnerable:
Check pg_ivm extension version: SELECT * FROM pg_available_extensions WHERE name = 'pg_ivm';Check Version:
SELECT extversion FROM pg_extension WHERE extname = 'pg_ivm';Verify Fix Applied:
Verify version is 1.5.1 or higher: SELECT extversion FROM pg_extension WHERE extname = 'pg_ivm';📡 Detection & Monitoring
Log Indicators:
- Unexpected function executions during IMMV refresh operations
- Errors related to missing schema qualifications in pg_ivm logs
Network Indicators:
- Unusual database activity patterns coinciding with IMMV refresh schedules
SIEM Query:
SELECT * FROM postgresql_logs WHERE message LIKE '%pg_ivm%' AND (message LIKE '%ERROR%' OR message LIKE '%unexpected%function%')