Postgres Security Patches Related to the Search Path

1 min read

Aug 19, 2020

There were some security patches released this month for Postgres, to put further restrictions on pathways that malicious users could use to leverage the search_path to insert malicious code.

What is the search path?

What is search_path? Postgres has a database/schema/table hierarchy. If you specify a table without the schema, then Postgres will look for the table within the schemas listed in the search path. See https://www.postgresql.org/docs/12/runtime-config-client.html Here's the default search_path:

postgres=# show search_path;
 search_path 
 -----------------
 "$user", public

Example of not using schema name in query:

postgres=# select * from firstname limit 5;
 first_name
 ------------
 Aach
 Aachie
 Aachje
 Aacht
 Aachte
 (5 rows)

Exploit Pathways and Remediations

Functions are one way malicious users can exploit default search paths. After the first security hole was found, here were some remediations. (And these continue to inform best practices.) https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058%3A_Protect_Your_Search_Path The patch to that CVE https://github.com/postgres/postgres/commit/582edc369cdbd348d68441fc50fa26a84afd0c1a forced an empty search path for some users/backend processes. Here's the code to empty the search path: https://github.com/postgres/postgres/blob/cec57b1a0fbcd3833086ba686897c5883e0a2afc/src/include/common/connect.h#L25 If you do that on your command line, the schema is required in queries:

postgres=# SELECT pg_catalog.set_config('search_path', '', false);
 postgres=# select * from firstname limit 5;
 ERROR: relation "firstname" does not exist
 LINE 1: select * from firstname limit 5;
 ^
 postgres=# select * from public.firstname limit 5;
 first_name
 ------------
 Aach
 Aachie
 Aachje
 Aacht
 Aachte
 (5 rows)

This "empty search path" has been extended this week to cover an additional security hole, in logical replication and extensions: https://github.com/postgres/postgres/commit/11da97024abbe76b8c81e3f2375b2a62e9717c67

Recommendations

Security patches available should be applied, especially for users of logical replication. The patch unfortunately doesn't cover all pathways to malicious use of extensions, but should be done anyway. As a stopgap (especially, for example on managed cloud installations) until this can be updated, follow the tips in https://wiki.postgresql.org/wiki/A_Guide_to_CVE-2018-1058%3A_Protect_Your_Search_Path