critical
10
CWE
89
Advisory Published
Advisory Published
Updated

CVE-2024-1597: pgjdbc SQL Injection via line comment generation

First published: Mon Feb 19 2024(Updated: )

# Impact SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code that has a vulnerable SQL that negates a parameter value. There is no vulnerability in the driver when using the default query mode. Users that do not override the query mode are not impacted. # Exploitation To exploit this behavior the following conditions must be met: 1. A placeholder for a numeric value must be immediately preceded by a minus (i.e. `-`) 1. There must be a second placeholder for a string value after the first placeholder on the same line. 1. Both parameters must be user controlled. The prior behavior of the driver when operating in simple query mode would inline the negative value of the first parameter and cause the resulting line to be treated as a `--` SQL comment. That would extend to the beginning of the next parameter and cause the quoting of that parameter to be consumed by the comment line. If that string parameter includes a newline, the resulting text would appear unescaped in the resulting SQL. When operating in the default extended query mode this would not be an issue as the parameter values are sent separately to the server. Only in simple query mode the parameter values are inlined into the executed SQL causing this issue. # Example ```java PreparedStatement stmt = conn.prepareStatement("SELECT -?, ?"); stmt.setInt(1, -1); stmt.setString(2, "\nWHERE false --"); ResultSet rs = stmt.executeQuery(); ``` The resulting SQL when operating in simple query mode would be: ```sql SELECT --1,' WHERE false --' ``` The contents of the second parameter get injected into the command. Note how both the number of result columns and the WHERE clause of the command have changed. A more elaborate example could execute arbitrary other SQL commands. # Patch Problem will be patched upgrade to 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28, 42.2.28.jre7 The patch fixes the inlining of parameters by forcing them all to be serialized as wrapped literals. The SQL in the prior example would be transformed into: ```sql SELECT -('-1'::int4), (' WHERE false --') ``` # Workarounds Do not use the connection property`preferQueryMode=simple`. (*NOTE: If you do not explicitly specify a query mode then you are using the default of `extended` and are not impacted by this issue.*)

Credit: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Affected SoftwareAffected VersionHow to fix
maven/org.postgresql:postgresql>=42.7.0<42.7.2
42.7.2
maven/org.postgresql:postgresql>=42.6.0<42.6.1
42.6.1
maven/org.postgresql:postgresql>=42.5.0<42.5.5
42.5.5
maven/org.postgresql:postgresql>=42.4.0<42.4.4
42.4.4
maven/org.postgresql:postgresql>=42.3.0<42.3.9
42.3.9
maven/org.postgresql:postgresql<42.2.28
42.2.28
redhat/PostgreSQL JDBC Driver<42.7.2
42.7.2
redhat/PostgreSQL JDBC Driver<42.6.1
42.6.1
redhat/PostgreSQL JDBC Driver<42.5.5
42.5.5
redhat/PostgreSQL JDBC Driver<42.4.4
42.4.4
redhat/PostgreSQL JDBC Driver<42.3.9
42.3.9
redhat/PostgreSQL JDBC Driver<42.2.28
42.2.28
redhat/PostgreSQL JDBC Driver<42.2.28.
42.2.28.
IBM IBM® Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data<=v3.5 through refresh 10v4.0 through refresh 9v4.5 through refresh 3v4.6 through refresh 6v4.7 through refresh 4v4.8 through refresh 4
Postgresql Postgresql Jdbc Driver<42.2.28
Postgresql Postgresql Jdbc Driver>=42.3.0<42.3.9
Postgresql Postgresql Jdbc Driver>=42.4.0<42.4.4
Postgresql Postgresql Jdbc Driver>=42.5.0<42.5.5
Postgresql Postgresql Jdbc Driver>=42.6.0<42.6.1
Postgresql Postgresql Jdbc Driver>=42.7.0<42.7.2
Fedoraproject Fedora=40
maven/org.postgresql:postgresql<42.2.8
42.2.8
<42.2.28
>=42.3.0<42.3.9
>=42.4.0<42.4.4
>=42.5.0<42.5.5
>=42.6.0<42.6.1
>=42.7.0<42.7.2
=40

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203