CVE-2024-4317: PostgreSQL Information Disclosure Flaw

CVE-2024-4317 Overview

CVE-2024-4317 is a Missing Authorization vulnerability affecting PostgreSQL database systems. The vulnerability exists in the built-in views pg_stats_ext and pg_stats_ext_exprs, which allow an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. This information disclosure issue enables unauthorized access to sensitive statistical data that may reveal column values or function results that the attacker should not have access to.

Critical Impact

An unprivileged database user can access sensitive statistical data including most common values and function results from other users' CREATE STATISTICS commands, potentially exposing confidential information without proper authorization.

Affected Products

• PostgreSQL versions 16.0 through 16.2 (before 16.3)
• PostgreSQL versions 15.0 through 15.6 (before 15.7)
• PostgreSQL versions 14.0 through 14.11 (before 14.12)

Discovery Timeline

• 2024-05-14 - CVE-2024-4317 published to NVD
• 2025-03-28 - Last updated in NVD database

Technical Details for CVE-2024-4317

Vulnerability Analysis

This vulnerability stems from a Missing Authorization issue (CWE-862) in PostgreSQL's extended statistics views. The pg_stats_ext and pg_stats_ext_exprs system views are designed to provide access to statistics created via the CREATE STATISTICS command. However, these views fail to properly enforce access controls, allowing any authenticated database user to query statistical data belonging to other users.

The exposure is particularly concerning because extended statistics can contain most common values (MCV) lists that directly reveal actual data values from columns. Additionally, if statistics were created on expression results, an attacker could potentially infer the output of functions they are not authorized to execute. The network-accessible nature of PostgreSQL deployments means that any user with basic database authentication can exploit this vulnerability remotely.

Root Cause

The root cause is a missing authorization check in the implementation of the pg_stats_ext and pg_stats_ext_exprs views. These views were designed to expose extended statistics information but failed to include proper row-level security or ownership verification. As a result, the views return statistics data regardless of whether the querying user owns the underlying statistics objects or has permission to access the associated table columns.

This is a design flaw in the view definitions that shipped with affected PostgreSQL versions. The authorization gap means that while users cannot directly query restricted tables, they can observe aggregate statistical properties about those tables through these improperly secured views.

Attack Vector

The attack leverages standard SQL queries against the vulnerable system catalog views. An attacker with any level of authenticated access to the PostgreSQL database can simply query the pg_stats_ext or pg_stats_ext_exprs views to enumerate and retrieve statistics belonging to other database users.

The attack scenario involves an attacker querying the system views to discover extended statistics objects created by other users, then extracting the most common values (MCV) lists which may contain actual sensitive data values. This enables information gathering about restricted tables without directly querying them, and the attacker can infer results of privileged functions through expression statistics.

Detection Methods for CVE-2024-4317

Indicators of Compromise

• Unusual or unexpected queries against pg_stats_ext and pg_stats_ext_exprs views in PostgreSQL logs
• Low-privileged users accessing system catalog views containing extended statistics
• Elevated query activity from database users targeting statistical metadata
• Access patterns showing users querying statistics on tables they do not own

Detection Strategies

• Enable PostgreSQL query logging (log_statement = 'all') and monitor for queries to pg_stats_ext and pg_stats_ext_exprs
• Implement database activity monitoring to alert on cross-user access to extended statistics views
• Review pg_stat_statements extension data for patterns of catalog view access by unprivileged accounts
• Audit database user permissions and correlate with access to sensitive statistical data

Monitoring Recommendations

• Configure alerts for queries to pg_stats_ext and pg_stats_ext_exprs from non-administrative accounts
• Deploy SentinelOne Singularity to monitor database server activity and detect anomalous access patterns
• Implement periodic review of database audit logs for signs of information gathering activity
• Monitor for new user accounts or privilege changes that could enable exploitation

How to Mitigate CVE-2024-4317

Immediate Actions Required

• Upgrade PostgreSQL to patched versions: 16.3, 15.7, or 14.12 or later
• Follow the post-upgrade instructions in the PostgreSQL release notes to remediate existing installations
• Review and audit which users have access to extended statistics in your databases
• Restrict database user permissions to the minimum required for their function

Patch Information

PostgreSQL has released security updates to address this vulnerability. The fixed versions are PostgreSQL 16.3, 15.7, and 14.12. It is critical to note that simply installing an updated version is not sufficient for existing installations. Administrators must follow the specific remediation instructions provided in the PostgreSQL release notes to properly secure existing databases. Fresh installations created with initdb after upgrading are not affected.

For detailed patch information and remediation steps, refer to the PostgreSQL CVE-2024-4317 Advisory.

Workarounds

• Revoke unnecessary access to the affected system catalog views for unprivileged users
• Limit database user creation and enforce strict access control policies
• Consider dropping extended statistics objects that contain sensitive data if they are not essential
• Implement network segmentation to restrict database access to trusted hosts only
• Use database-level auditing to track all access to statistical views until patching is complete

# Verify your PostgreSQL version and check if patching is required
psql -c "SELECT version();"

# After upgrading, run the remediation script from the release notes
# Example: Execute the fix script provided by PostgreSQL
psql -f /path/to/fix_cve_2024_4317.sql

# Verify the fix was applied
psql -c "SELECT * FROM pg_stats_ext LIMIT 1;" --username=unprivileged_user
# Should return restricted results after remediation