External risk intelligence

pREST SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-58450

pREST is explicitly designed as an API service that exposes a PostgreSQL database via RESTful endpoints. Because its primary function is to serve as a web-accessible API gateway, it is commonly deployed as an internet-facing service or an edge-accessible component, making public network reachability a standard part of its operational pattern.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

pREST, an API service built on top of PostgreSQL, has a critical vulnerability that could allow unauthorized access and manipulation of data. This issue stems from inadequate input validation in versions prior to 2.0.0-rc3, which can be exploited through SQL injection. The main concern is confirming relevance and exposure, as the potential impact depends on whether this technology is used within the organization.

API allows database manipulation.
Critical flaw risks unauthorized data access.
Confirm if this API is in use.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable pREST API over the network without needing any special access or authentication. The API, which provides access to a PostgreSQL database, does not sufficiently validate user input, allowing an attacker to inject malicious SQL commands. Successful injection can lead to significant compromise of the database's data.

Accessible via public network.
Input validation flaws allow SQL injection.
Potentially severe data breaches.

Live Threat

Current exploitation, exposure, and threat context

pREST, an API service for PostgreSQL databases, could be at risk from SQL injection when its validation is inadequate, potentially allowing unauthorized access to or manipulation of the underlying database. This vulnerability could affect system data or user data when the API is accessible over a network and not properly secured.

Database data and system integrity.
Via network-accessible API endpoints.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this SQL injection vulnerability in pREST, as it acts as an API layer over PostgreSQL databases. The first practical step is to inventory all pREST deployments, determine their network exposure and business criticality, and identify the specific accountable owner for each instance. This information will inform a risk-based remediation plan, coordinating with the vendor where necessary.

Ownership: Application or platform teams.
Verify: Network exposure and business criticality.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is pREST?

pREST is a service that functions as a lightweight API layer, automatically turning your PostgreSQL database into a RESTful API. Developers use it to quickly expose database operations through standard web requests, allowing applications to interact with data without needing to write extensive backend code.

What does SQL injection mean for CVE-2025-58450?

This vulnerability, classified as CWE-89, means the software fails to properly sanitize user input. Because the API does not sufficiently validate data before processing it, an attacker can input malicious SQL commands. These commands are then executed by the underlying database, potentially allowing unauthorized access or modification of your data.

How is this SQL injection flaw triggered?

The flaw is triggered when an attacker sends specifically crafted requests to the API endpoints that communicate with the database. Because the vulnerability exists in the input validation logic itself, it can be triggered by any network-accessible request that bypasses standard checks. Requests that do not interact with the database or that use updated, non-vulnerable versions of the software do not trigger this specific issue.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal labels this as a high-relevance issue because pREST is purpose-built to act as an internet-facing or edge-accessible gateway. Since its standard operation involves exposing database functions to network traffic, any instance reachable over the network—especially the public internet—is considered to have a higher potential for exposure.

What steps should I take if I use pREST?

Your first step is to inventory all instances of pREST currently running in your environment. Once identified, confirm the specific version in use and prioritize those that are internet-facing for review. Coordinate with your application or platform teams to transition to version 2.0.0-rc3 or later, which includes the necessary security patch to address the input validation weaknesses.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.