CVE-2024-1713: Plv8 Privilege Escalation Vulnerability

CVE-2024-1713 Overview

CVE-2024-1713 is a privilege escalation vulnerability in plv8 version 3.2.1, a JavaScript language extension for PostgreSQL. A user who can create objects in a database with plv8 installed can cause deferred triggers to execute as the PostgreSQL Superuser during autovacuum operations. This flaw allows a low-privileged database user with object creation rights to gain full administrative control over the database. The vulnerability affects confidentiality, integrity, and availability of the database and any data it stores.

Critical Impact
Attackers with database object creation privileges can execute arbitrary code as the PostgreSQL Superuser, resulting in full database compromise.

Affected Products

plv8 3.2.1 (PostgreSQL JavaScript language extension)
PostgreSQL deployments with plv8 3.2.1 installed
Databases granting object creation privileges to non-superuser roles

Discovery Timeline

2024-03-14 - CVE-2024-1713 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1713

Vulnerability Analysis

The vulnerability arises from how plv8 3.2.1 handles deferred trigger execution during PostgreSQL autovacuum operations. Autovacuum is a background maintenance process that runs with elevated privileges, typically as the Superuser role. When a deferred trigger authored by a low-privileged user fires during an autovacuum-initiated context, the attacker's JavaScript code executes under Superuser authority instead of the object owner's authority.

This represents an unusual condition control failure classified under [CWE-394] and [CWE-754], where the extension does not properly validate the security context before running user-defined JavaScript. Any user granted CREATE on a schema in a plv8-enabled database can weaponize this behavior. The Exploit Prediction Scoring System places this issue in a moderate exploitation-likelihood range, but the impact of a successful attack is total database compromise.

Root Cause

The root cause is missing security context enforcement inside plv8 when deferred triggers execute during autovacuum. The extension does not switch to the trigger owner's role before invoking the JavaScript function body, allowing the code to inherit the autovacuum worker's Superuser privileges.

Attack Vector

An attacker first authenticates to the database with a non-privileged role that holds CREATE privileges on any schema. The attacker creates a table and a deferred trigger containing a malicious plv8 JavaScript function. When autovacuum next processes that table, the deferred trigger fires under the Superuser context, allowing the attacker's function to modify roles, exfiltrate data, or execute additional SQL as Superuser. Details of the exploitation path are documented in the GitHub Security Advisory GHSA-r7m9-grw7-vcc4.

Detection Methods for CVE-2024-1713

Indicators of Compromise

Creation of deferred triggers containing plv8 (LANGUAGE plv8) function bodies by non-superuser roles
PostgreSQL audit log entries showing role changes, GRANT statements, or ALTER ROLE ... SUPERUSER originating from autovacuum worker processes
Unexpected schema, role, or extension modifications immediately following autovacuum runs
New PostgreSQL roles created outside of provisioning workflows

Detection Strategies

Query pg_trigger and pg_proc to enumerate all deferred triggers whose function language is plv8 and whose owner is not a trusted administrator
Enable pgaudit or equivalent statement logging to capture privileged SQL executed within trigger contexts
Alert on any ALTER ROLE, CREATE ROLE, or GRANT statements executed by autovacuum background workers

Monitoring Recommendations

Forward PostgreSQL audit and error logs to a centralized data lake for correlation across sessions and background workers
Baseline normal autovacuum activity and alert on SQL statements that deviate from routine maintenance operations
Review privileges granted on plv8 and on schemas in shared multi-tenant databases on a recurring basis

How to Mitigate CVE-2024-1713

Immediate Actions Required

Upgrade plv8 to a version later than 3.2.1 that addresses the deferred trigger privilege issue
Revoke CREATE privileges on schemas in plv8-enabled databases from untrusted roles until the patch is applied
Audit all existing deferred triggers using plv8 and remove any created by non-administrative users

Patch Information

Refer to the upstream project and the GitHub Security Advisory GHSA-r7m9-grw7-vcc4 for the fixed release and patch details. Apply the update to every PostgreSQL instance that has plv8 3.2.1 installed, including replicas and disaster recovery nodes.

Workarounds

Remove the plv8 extension from databases that do not require JavaScript stored procedures using DROP EXTENSION plv8
Restrict USAGE on the plv8 language to trusted administrative roles only via REVOKE USAGE ON LANGUAGE plv8 FROM PUBLIC
Disable autovacuum on tables owned by untrusted users until the extension is patched, accepting the maintenance trade-off
Enforce least privilege by ensuring application roles cannot create triggers on tables they do not own

bash

# Configuration example: restrict plv8 usage and audit deferred triggers
REVOKE USAGE ON LANGUAGE plv8 FROM PUBLIC;
REVOKE CREATE ON SCHEMA public FROM PUBLIC;

# Enumerate deferred plv8 triggers owned by non-superusers
SELECT n.nspname, c.relname, t.tgname, p.proname, r.rolname
FROM pg_trigger t
JOIN pg_class c ON t.tgrelid = c.oid
JOIN pg_namespace n ON c.relnamespace = n.oid
JOIN pg_proc p ON t.tgfoid = p.oid
JOIN pg_language l ON p.prolang = l.oid
JOIN pg_roles r ON p.proowner = r.oid
WHERE l.lanname = 'plv8'
  AND t.tgdeferrable = true
  AND r.rolsuper = false;