The Register: Critical PostgreSQL bug tied to zero-day attack on US Treasury

Feb 14, 2025

—

Source URL: https://www.theregister.com/2025/02/14/postgresql_bug_treasury/
Source: The Register
Title: Critical PostgreSQL bug tied to zero-day attack on US Treasury

Feedly Summary: High-complexity bug unearthed by infoseccers, as Rapid7 probes exploit further
A high-severity SQL injection bug in the PostgreSQL interactive tool was exploited alongside the zero-day used to break into the US Treasury in December, researchers say.…

AI Summary and Description: Yes

Summary: The text discusses a high-severity SQL injection vulnerability (CVE-2025-1094) in the PostgreSQL interactive tool and its critical role in an exploit chain involving another zero-day vulnerability targeting BeyondTrust software. The analysis highlights the interconnectedness of vulnerabilities and the implications for security against SQL injection attacks.

Detailed Description:
The text shadows the discovery and implications of the SQL injection bug in PostgreSQL’s interactive tool, focusing on its significance in recent security incidents. Here are the key points:

– **Vulnerability Discovery**: Rapid7’s principal security researcher, Stephen Fewer, disclosed a critical SQL injection vulnerability (CVE-2025-1094) that is key to exploiting another vulnerability in BeyondTrust software (CVE-2024-12356).

– **Exploit Chain**: The analysis indicates that CVE-2025-1094 was essential for executing the BeyondTrust attack, implying that it was not possible to achieve remote code execution without utilizing this PostgreSQL bug.

– **Severity and Complexity**: While the vulnerability is severe in nature, it was noted that exploiting it successfully is not straightforward. Even so, its potential for arbitrary code execution (ACE) poses significant risks, particularly given its association with other vulnerabilities.

– **Root Cause and Patching**: Although BeyondTrust issued a patch for CVE-2024-12356 in December 2024 that addresses its exploitation, it failed to rectify the cause of the PostgreSQL vulnerability, which remained a zero-day until identified by Rapid7.

– **Exploitation Mechanics**: The SQL injection vulnerability stems from a misconception that SQL injection attacks cannot occur when input is safely escaped. However, specific input scenarios can bypass these protections, leading to unauthorized command execution via the PostgreSQL interactive tool.

– **Mitigation Measures**: Users are advised to update to the latest PostgreSQL versions released on February 13 to protect against the vulnerabilities as indicated.

– **Community Interaction**: The disclosure process received commendation for its transparency, underscoring the importance of coordinated vulnerability disclosure in enhancing software security.

This analysis provides critical insights into the emerging trends in vulnerability exploitation, particularly how SQL injection vulnerabilities can serve as gateways for broader attacks, which is invaluable for security professionals focused on identifying and mitigating security threats in cloud and infrastructure environments.

1 2 2024 24 3 4 5 7 a Act AI analysis and API arbitrary code execution Arch art as attack attacks BeyondTrust Bug by bypass C chain CIA closed Cloud code code execution command command execution community complexity concept Coordinated Vulnerability Disclosure critical CVE D day day attack day vulnerability de disclosure e emerging trends end environment execution exp exploit exploit chain Exploitation fail focused for full g Gateway gateways GIS gs high Highlight HR http HTTPS implications in incident infosec infrastructure injection injection bug injection vulnerabilities Injection vulnerability insights inter interaction iOS ite J k Key l led long man mitigation mitigation measures no NPU o of on out over Patch patching point post Postgre Postgres PostgreSQL potential process professionals R RCE release Remote Code Execution research researchers Risk risks Ro Role Root RoT Rust s safe search sec security security incident security incidents security professionals Security Research Security Researcher security threat security threats severity SHA side Sig SoC software software security source specific sql SSE T test text the threat threats to tool TP transparency Treasury trends trust up update US use user Users uth V val version vulnerabilities vulnerability vulnerability disclosure vulnerability discovery Vulnerability Exploitation Wi x zero zero-day zero-day vulnerability