PostgreSQL SQL Injection Vulnerability in Quoting APIs

A SQL injection vulnerability has been identified in PostgreSQL's libpq quoting functions: PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn(). This issue arises from improper handling of quoting syntax, which can be exploited under certain conditions. Specifically, the vulnerability is present in PostgreSQL versions prior to 17.3, 16.7, 15.11, 14.16, and 13.19. The injection occurs when the function's output is used to create input for psql, the PostgreSQL interactive terminal. Additionally, similar quoting issues in PostgreSQL command line utilities can lead to SQL injection when the client_encoding is set to BIG5 and the server_encoding is either EUC_TW or MULE_INTERNAL.

Impact

Exploitation of this vulnerability allows for SQL injection, which could lead to unauthorized data access, data manipulation, or execution of arbitrary SQL commands.

Reproduction

To reproduce this vulnerability, use a PostgreSQL version prior to the patched releases. Apply a client_encoding of BIG5 and a server_encoding of EUC_TW or MULE_INTERNAL. Then, utilize the unpatched PQescape functions in a way that the output is not properly sanitized before being used as input in psql or a vulnerable command line utility.

Remediation

Upgrade to PostgreSQL versions 17.3, 16.7, 15.11, 14.16, or 13.19. For Debian 11, the update is available in version 13.20-0+deb11u1.