Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in pglogical, a PostgreSQL replication tool, that could allow a malicious party to execute arbitrary commands with superuser privileges on a subscriber system. This occurs when replicated changes are applied to a table missing columns, causing default expressions to run with elevated permissions. While complex to exploit, it represents a significant risk if non-superuser roles have been delegated subscription management privileges in managed deployments.
- Elevated privileges possible through replication changes.
- Critical for managed deployments with delegated permissions.
- Confirm relevance and exposure; mitigate if necessary.
Attack Path
How an attacker could exploit the issue
An attacker with publisher privileges could manipulate data replication to execute arbitrary functions on a subscriber's database. This is achieved by creating a subscription to an endpoint they control and causing the system to evaluate default expressions with missing columns, which then triggers functions to run with elevated privileges. In typical setups, this capability is restricted to superusers, but in managed environments where non-superusers can create subscriptions, this opens a path for privilege escalation.
- Requires control over a subscription endpoint.
- Triggered by replicating rows with missing columns.
- Leads to arbitrary code execution as superuser.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow a malicious publisher to execute arbitrary functions as a superuser on a subscriber system. This could happen when changes are replicated for a row with missing columns and the subscriber evaluates default expressions that invoke these functions. The risk is heightened in managed deployments where non-superusers are delegated the ability to create subscriptions.
- Attacker-controlled subscription endpoints.
- Replication of rows with missing columns.
- Full superuser access on subscriber.
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability allows a publisher to execute arbitrary functions on a subscriber with superuser privileges, primarily impacting managed PostgreSQL deployments where subscription creation is delegated. The first practical step is to identify all pglogical subscriptions, assess their reachability to controlled endpoints, confirm business criticality, and identify the accountable database or platform team. Remediation planning should then be risk-based, considering potential vendor coordination or temporary risk reduction strategies.
- Database and Platform teams own this issue.
- Verify pglogical subscription configurations.
- Plan remediation based on risk.
