Postgres Security Patches Related to the Search Path
There were some security patches released this month for Postgres, to put further restrictions on pathways that malicious users could use to leverage the search_path to insert malicious code.
What is the search path?
What is search_path? Postgres has a database/schema/table hierarchy. If you specify a table without the schema, then Postgres will look for the table within the schemas listed in the search path. See https://www.postgresql.org/docs/12/runtime-config-client.html Here's the default search_path:postgres=# show search_path; search_path ----------------- "$user", publicExample of not using schema name in query:
postgres=# select * from firstname limit 5; first_name ------------ Aach Aachie Aachje Aacht Aachte (5 rows)
Exploit Pathways and Remediations
Functions are one way malicious users can exploit default search paths. After the first security hole was found, here were some remediations. (And these continue to inform best practices.) https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058%3A_Protect_Your_Search_Path The patch to that CVE https://github.com/postgres/postgres/commit/582edc369cdbd348d68441fc50fa26a84afd0c1a forced an empty search path for some users/backend processes. Here's the code to empty the search path: https://github.com/postgres/postgres/blob/cec57b1a0fbcd3833086ba686897c5883e0a2afc/src/include/common/connect.h#L25 If you do that on your command line, the schema is required in queries:postgres=# SELECT pg_catalog.set_config('search_path', '', false);
postgres=# select * from firstname limit 5;
ERROR: relation "firstname" does not exist
LINE 1: select * from firstname limit 5;
^
postgres=# select * from public.firstname limit 5;
first_name
------------
Aach
Aachie
Aachje
Aacht
Aachte
(5 rows) This "empty search path" has been extended this week to cover an additional security hole, in logical replication and extensions:
https://github.com/postgres/postgres/commit/11da97024abbe76b8c81e3f2375b2a62e9717c67
