PostgreSQL Symlink Following Vulnerability in pg_basebackup and pg_rewind Allowing File Overwrite

A symlink following vulnerability has been identified in PostgreSQL's pg_basebackup plain format and in pg_rewind. This vulnerability allows an origin superuser to overwrite local files, such as /var/lib/postgres/.bashrc, potentially hijacking the operating system account. The issue arises in versions prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23. The vulnerability's impact is practical only if relevant actions are taken between executing these commands and starting the server, such as transferring the overwritten files to a different virtual machine or snapshotting the VM.

Impact

Exploitation of this vulnerability can lead to unauthorized overwriting of local files, with the potential to hijack the operating system account of the PostgreSQL superuser.

Remediation

Users can upgrade to PostgreSQL versions 18.4, 17.10, 16.14, 15.18, or 14.23 to address this vulnerability.