PT-2019-19427 · Postgresql+1 · Postgresql+1

Jacob Wilkin · Publicado 2019-04-01 · Atualizado 2026-03-10 · CVE-2019-9193

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.3 through 11.2

Description The issue allows superusers and users in the 'pg execute server program' group to execute arbitrary code in the context of the database's operating system user through the "COPY TO/FROM PROGRAM" function. This functionality can be abused to run arbitrary operating system commands on Windows, Linux, and macOS.

Recommendations For PostgreSQL versions 9.3 through 11.2, consider restricting access to the 'COPY TO/FROM PROGRAM' function to prevent arbitrary code execution, or remove users from the 'pg execute server program' group unless necessary. As a temporary workaround, consider disabling the 'COPY TO/FROM PROGRAM' function until a more permanent solution is available.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

ALT-PU-2019-1785

ALT-PU-2019-1786

ALT-PU-2019-1787

ALT-PU-2019-1788

CESA-2020_3669

CESA-2020_5619

CVE-2019-9193

RHSA-2020_3669

RHSA-2020_5619

Produtos afetados

Alt Linux

Postgresql

Referências · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/postgres/postgres_copy_from_program_cmd_exec.rb · Exploit
• 🔥 https://github.com/b4keSn4ke/CVE-2019-9193 · Exploit
• 🔥 https://github.com/wkjung0624/cve-2019-9193 · Exploit
• 🔥 https://github.com/geniuszly/CVE-2019-9193 · Exploit
• 🔥 https://github.com/geniuszlyy/CVE-2019-9193 · Exploit
• 🔥 https://github.com/wkjung0624/CVE-2019-9193 · Exploit
• 🔥 https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5 · Exploit
• 🔥 https://exploit-db.com/exploits/46813 · Exploit
• 🔥 https://exploit-db.com/exploits/50847 · Exploit
• 🔥 https://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/51247 · Exploit
• 🔥❌ https://github.com/psauxx/CVE-2019-9193 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2019-9193 · Nota de Segurança
• http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html · Nota
• https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program · Nota