CVE-2023-41117
📋 TL;DR
This vulnerability in EnterpriseDB Postgres Advanced Server (EPAS) allows attackers to execute arbitrary code by exploiting search_path attacks against SECURITY DEFINER functions. It affects all EPAS versions before specific patched releases. Attackers with database access can escalate privileges to execute code as the database owner.
💻 Affected Systems
- EnterpriseDB Postgres Advanced Server (EPAS)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise leading to data theft, data manipulation, and potential lateral movement to the underlying operating system.
Likely Case
Privilege escalation allowing attackers to execute arbitrary SQL commands as the database owner, potentially accessing sensitive data or modifying database structures.
If Mitigated
Limited impact if proper access controls and network segmentation are in place, restricting database access to authorized users only.
🎯 Exploit Status
Requires authenticated database access. Exploitation involves manipulating search_path to execute malicious code through SECURITY DEFINER functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.21.32, 12.16.20, 13.12.16, 14.9.0, 15.4.0
Vendor Advisory: https://www.enterprisedb.com/docs/security/advisories/cve202341117/
Restart Required: Yes
Instructions:
1. Download appropriate patched version from EnterpriseDB. 2. Backup database. 3. Stop EPAS service. 4. Apply patch/upgrade. 5. Restart EPAS service. 6. Verify version.
🔧 Temporary Workarounds
Restrict Database Access
allLimit database connections to trusted users and applications only
Configure pg_hba.conf to restrict connections
Use firewall rules to limit database port access
Review SECURITY DEFINER Functions
allAudit and potentially disable unnecessary SECURITY DEFINER functions
SELECT proname FROM pg_proc WHERE prosecdef = true;
REVOKE EXECUTE ON FUNCTION function_name FROM PUBLIC;
🧯 If You Can't Patch
- Implement strict network segmentation to isolate database servers
- Enforce least privilege access controls and monitor for suspicious database activity
🔍 How to Verify
Check if Vulnerable:
Check EPAS version: SELECT version(); and compare against affected versionsCheck Version:
SELECT version();Verify Fix Applied:
Verify version is at or above patched versions: SELECT version();📡 Detection & Monitoring
Log Indicators:
- Unusual search_path modifications
- Suspicious SECURITY DEFINER function executions
- Privilege escalation attempts
Network Indicators:
- Unexpected database connections from unauthorized sources
SIEM Query:
source="postgresql" AND ("search_path" OR "SECURITY DEFINER")