CVE-2022-26520 pgjdbc Arbitrary File Write Vulnerability
An attacker controlling JDBC connection properties can write arbitrary files, potentially leading to remote code execution via web shell creation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-26520?
CVE-2022-26520 is a critical path traversal vulnerability in Debian Debian Linux, published on 7 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties
Which versions are affected by CVE-2022-26520?
5 open source packages ship an affected version, including org.postgresql:postgresql and postgresql-jdbc-driver. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.postgresql:postgresql Maven | From 42.1.0 | 42.3.3 |
org.postgresql:postgresql Maven | From 42.1.0 | 42.3.3 |
org.postgresql:postgresql Maven | From 42.1.0 | 42.3.3 |
org.postgresql:postgresql Maven | From 42.1.0 | 42.3.3 |
postgresql-jdbc-driver Bitnami | From 42.1.0 | 42.1.5, 42.3.3 |
Linux distribution packages (11)
ongres-scram SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 2.1-150300.3.3.4 |
ongres-stringprep SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 1.1-150300.7.3.4 |
postgresql-jdbc SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 42.2.25-150300.3.5.2 |
postgresql-jdbc SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 42.2.25-150400.3.3.2 |
ongres-scram SUSE:Manager Server Module 4.2 | All versions | 2.1-150300.3.3.4 |
ongres-stringprep SUSE:Manager Server Module 4.2 | All versions | 1.1-150300.7.3.4 |
postgresql-jdbc SUSE:Manager Server Module 4.2 | All versions | 42.2.25-150300.3.5.2 |
ongres-scram openSUSE:Leap 15.3 | All versions | 2.1-150300.3.3.4 |
ongres-stringprep openSUSE:Leap 15.3 | All versions | 1.1-150300.7.3.4 |
postgresql-jdbc openSUSE:Leap 15.3 | All versions | 42.2.25-150300.3.5.2 |
postgresql-jdbc openSUSE:Leap 15.4 | All versions | 42.2.25-150400.3.3.2 |
Products include Debian Debian Linux, Postgresql Postgresql Jdbc Driver.
How do I fix CVE-2022-26520?
Upgrade org.postgresql:postgresql to 42.3.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-26520 being exploited?
There is no known exploitation of CVE-2022-26520 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-postgresql-jdbc-driver-2022-26520, CLEANSTART-2026-DT34494, CLEANSTART-2026-NM72661, DEBIAN-CVE-2022-26520, GHSA-673j-qm5f-xpv8, GHSA-727h-hrw8-jg8q and 3 more.