Multiple cloud vendors impacted by PostgreSQL vulnerability that exposed enterprise databases

guest · Aug 16, 2022

Flaws discovered in various PostgreSQL-as-a-Service offerings, including those from Microsoft and Google
August 16, 2022

Wiz Research has found vulnerabilities in popular ‘PostgreSQL-as-a-Service’ offerings from various cloud vendors, introduced by the cloud vendors themselves.

Earlier this year, the security outfit discovered a chain of critical vulnerabilities in Microsoft Azure Database for PostgreSQL Flexible Server.
The exploit, named #ExtraReplica, allowed unauthorized read access to other customers’ PostgreSQL databases, bypassing tenant isolation.

“The isolation was not perfect, and we had network access from our managed instance to other customers’ instances, which opened an attack surface for other potential vulnerabilities,” Shir Tamari, head of research at Wiz, tells The Daily Swig.
Click to expand...

Decades-old bug
Wiz has now revealed that a similar vulnerability affects Google Cloud Platform (GCP), though with less severe potential effects.

“PostgreSQL’s permission model cannot provide a user only a set of superuser privileges. Therefore, cloud vendors had to introduce modifications to allow regular users a set of superuser capabilities. “
Click to expand...

In the case of Cloud SQL, while the team wasn’t able to gain superuser status, it was possible to access some of its privileges. One was the ability to arbitrarily change the ownership of a table to any user or role in the database.
Click to expand...

Wiz: The cloud has an isolation problem: PostgreSQL vulnerabilities affect multiple cloud vendors

How Wiz Research uncovered multiple related vulnerabilities in PostgreSQL-as-a-Service offerings from GCP, Azure, and others.
Click to expand...

Log in or Sign up

Multiple cloud vendors impacted by PostgreSQL vulnerability that exposed enterprise databases

guest Guest

Log in or Sign up

Multiple cloud vendors impacted by PostgreSQL vulnerability that exposed enterprise databases

guest Guest

Useful Searches