CVE-2022-1552: PostgreSQL Privilege Escalation Vulnerability

CVE-2022-1552 Overview

A privilege escalation vulnerability was discovered in PostgreSQL where several database maintenance operations fail to operate safely when a privileged user is maintaining objects owned by another user. The affected commands—Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck—either activate relevant security protections too late in their execution or fail to activate them entirely. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.

Critical Impact

Attackers with limited database privileges can escalate to superuser access, enabling complete database compromise including unauthorized data access, modification, and system command execution.

Affected Products

• PostgreSQL (multiple versions)
• Systems running PostgreSQL with multi-user configurations
• Enterprise deployments utilizing Autovacuum and maintenance commands

Discovery Timeline

• 2022-08-31 - CVE-2022-1552 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-1552

Vulnerability Analysis

This vulnerability stems from incomplete security measures implemented during privileged maintenance operations in PostgreSQL. When a database superuser performs maintenance tasks on objects owned by less privileged users, PostgreSQL should restrict the execution context to prevent privilege abuse. However, the affected commands fail to properly enforce these restrictions throughout their execution lifecycle.

The core issue lies in the timing of privilege checks and security context restrictions. Commands such as REINDEX and CREATE INDEX may execute user-defined functions (e.g., index expression functions or operator functions) during their operation. When these protections are applied too late or not at all, malicious functions embedded in seemingly innocuous database objects can execute with superuser privileges.

This vulnerability is classified under CWE-459 (Incomplete Cleanup) and CWE-89 (SQL Injection), reflecting both the incomplete security measure application and the potential for arbitrary SQL execution.

Root Cause

The root cause is the incomplete implementation of the SECURITY_RESTRICTED_OPERATION mode in PostgreSQL's maintenance commands. This mode is designed to prevent privilege escalation by restricting what user-defined functions can do when invoked from privileged operations. However, the affected commands either:

1. Activate the restricted mode after potentially dangerous operations have already begun
2. Fail to activate the restricted mode for certain code paths entirely
3. Leave gaps where user-defined code can execute before restrictions are applied

This allows a malicious user to craft database objects with embedded trigger functions, index expressions, or operator functions that execute arbitrary SQL when a superuser performs routine maintenance.

Attack Vector

The attack exploits the network-accessible PostgreSQL service and requires only low-level authenticated access (the ability to create non-temporary objects in at least one schema). An attacker would:

1. Create a malicious database object (such as a table with a specially crafted index expression or a trigger function)
2. Wait for a superuser to perform maintenance operations on the schema containing the malicious object
3. The malicious function executes with superuser privileges when the maintenance command processes the object
4. The attacker's code can then perform any operation available to a superuser, including creating new superuser accounts, accessing sensitive data, or executing system commands

This attack does not require user interaction beyond the routine database maintenance that superusers typically perform, often automatically via Autovacuum.

Detection Methods for CVE-2022-1552

Indicators of Compromise

• Unexpected user-defined functions or trigger functions in database schemas
• New superuser accounts or privilege grants that cannot be attributed to authorized administrators
• Unusual database objects in schemas accessible to unprivileged users
• Log entries showing function execution during REINDEX, VACUUM, or CREATE INDEX operations with unexpected results

Detection Strategies

• Monitor PostgreSQL logs for privilege escalation attempts during maintenance operations
• Audit user-defined functions and index expressions for suspicious SQL code
• Review database schemas for objects created by low-privilege users that contain executable code
• Implement database activity monitoring (DAM) to detect anomalous privilege usage patterns

Monitoring Recommendations

• Enable detailed logging of DDL operations and function executions in postgresql.conf
• Configure alerts for new superuser account creation or privilege modifications
• Monitor Autovacuum activity logs for unusual function invocations
• Deploy SentinelOne Singularity to detect post-exploitation activity at the endpoint level

How to Mitigate CVE-2022-1552

Immediate Actions Required

• Upgrade PostgreSQL to patched versions: 14.3, 13.7, 12.11, 11.16, or 10.21 immediately
• Audit existing database objects for potentially malicious functions before upgrading
• Restrict schema creation and object creation privileges to trusted users only
• Review and limit which users have CREATE permissions in shared schemas

Patch Information

PostgreSQL has released security updates addressing this vulnerability. The following versions contain the fix:

• PostgreSQL 14.3
• PostgreSQL 13.7
• PostgreSQL 12.11
• PostgreSQL 11.16
• PostgreSQL 10.21

Detailed information is available in the PostgreSQL CVE-2022-1552 Security Notice and the PostgreSQL Release Announcement. Additional vendor advisories are available from Red Hat, Gentoo, and NetApp.

Workarounds

• Restrict CREATE privileges on schemas to prevent untrusted users from creating objects
• Disable Autovacuum on schemas containing objects from untrusted users until patched
• Manually review all user-defined functions and index expressions before performing maintenance
• Consider running maintenance operations in a restricted environment until updates are applied

# Restrict CREATE privilege on public schema
psql -c "REVOKE CREATE ON SCHEMA public FROM PUBLIC;"

# Audit existing functions for suspicious content
psql -c "SELECT n.nspname, p.proname, p.prosrc FROM pg_proc p JOIN pg_namespace n ON p.pronamespace = n.oid WHERE n.nspname NOT IN ('pg_catalog', 'information_schema');"

# Check index expressions for potential malicious code
psql -c "SELECT schemaname, tablename, indexname, indexdef FROM pg_indexes WHERE indexdef LIKE '%(%';"