CVE-2019-9193 Command injection in n/a
Superusers can execute arbitrary OS commands via COPY TO/FROM PROGRAM, though this is intended functionality requiring high privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-9193?
CVE-2019-9193 is a high-severity command injection vulnerability in Postgresql Postgresql, published on 1 Apr 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.
Weakness: CWE-78
Which versions are affected by CVE-2019-9193?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2019-9193?
No fix has been published for CVE-2019-9193 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-9193 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-9193 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 9 proofs of concept on GitHub.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-j83j-hfqj-cf5p.