PT-2019-19427 · Postgresql+1 · Postgresql+1

Jacob Wilkin · Published 2019-04-01 · Updated 2026-03-10 · CVE-2019-9193

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 9.3 through 11.2

Description The issue allows superusers and users in the 'pg execute server program' group to execute arbitrary code in the context of the database's operating system user through the "COPY TO/FROM PROGRAM" function. This functionality can be abused to run arbitrary operating system commands on Windows, Linux, and macOS.

Recommendations For PostgreSQL versions 9.3 through 11.2, consider restricting access to the 'COPY TO/FROM PROGRAM' function to prevent arbitrary code execution, or remove users from the 'pg execute server program' group unless necessary. As a temporary workaround, consider disabling the 'COPY TO/FROM PROGRAM' function until a more permanent solution is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2019-1785

ALT-PU-2019-1786

ALT-PU-2019-1787

ALT-PU-2019-1788

CESA-2020_3669

CESA-2020_5619

CVE-2019-9193

RHSA-2020_3669

RHSA-2020_5619

Affected Products

Alt Linux

Postgresql

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/postgres/postgres_copy_from_program_cmd_exec.rb · Exploit
• 🔥 https://github.com/b4keSn4ke/CVE-2019-9193 · Exploit
• 🔥 https://github.com/wkjung0624/cve-2019-9193 · Exploit
• 🔥 https://github.com/geniuszly/CVE-2019-9193 · Exploit
• 🔥 https://github.com/geniuszlyy/CVE-2019-9193 · Exploit
• 🔥 https://github.com/wkjung0624/CVE-2019-9193 · Exploit
• 🔥 https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5 · Exploit
• 🔥 https://exploit-db.com/exploits/46813 · Exploit
• 🔥 https://exploit-db.com/exploits/50847 · Exploit
• 🔥 https://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/51247 · Exploit
• 🔥❌ https://github.com/psauxx/CVE-2019-9193 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2019-9193 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9193 · Vendor Advisory
• http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html · Note