CVE-2024-4317: PostgreSQL Information Disclosure Flaw

CVE-2024-4317 Overview

CVE-2024-4317 is a missing authorization vulnerability [CWE-862] in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs. An unprivileged database user can read most common values and other statistics produced by CREATE STATISTICS commands executed by other users. The exposed statistics may reveal column values the user could not otherwise read, or results of functions the user cannot execute. The flaw affects PostgreSQL major versions 14 through 16, specifically minor versions before 16.3, 15.7, and 14.12. Versions before PostgreSQL 14 are unaffected.

Critical Impact
An authenticated low-privilege database user can extract sensitive column values and function results from other users' data via extended statistics views, bypassing row-level and column-level access controls.

Affected Products

PostgreSQL 14.x prior to 14.12
PostgreSQL 15.x prior to 15.7
PostgreSQL 16.x prior to 16.3

Discovery Timeline

2024-05-14 - CVE-2024-4317 published to NVD by PostgreSQL Global Development Group
2025-03-28 - Last updated in NVD database following NetApp advisory ntap-20250328-0001

Technical Details for CVE-2024-4317

Vulnerability Analysis

The vulnerability stems from missing authorization checks in two PostgreSQL system views: pg_stats_ext and pg_stats_ext_exprs. These views surface extended statistics generated by the CREATE STATISTICS command, which the query planner uses to optimize queries on correlated columns and expressions.

Extended statistics include most common values (MCVs), histograms, and expression statistics. PostgreSQL did not enforce per-row visibility checks on these views, allowing any role connected to the database to read statistics for tables and expressions owned by other users.

An attacker with a standard LOGIN role can query these views to recover sample column values and computed expression results. This effectively bypasses table-level SELECT privileges, column-level grants, and row-level security policies that would otherwise prevent direct reads. It also exposes outputs of SECURITY DEFINER functions and other functions the attacker cannot invoke.

Root Cause

The pg_stats_ext and pg_stats_ext_exprs views were defined without filtering rows based on the querying user's privileges on the underlying objects. PostgreSQL applies access control to base catalogs but did not restrict the joined statistic columns surfaced through these views, resulting in unauthorized disclosure.

Attack Vector

Exploitation requires network access to the PostgreSQL instance and valid credentials for any database role. The attacker connects to the target database and issues SELECT statements against pg_stats_ext or pg_stats_ext_exprs, optionally filtering by schemaname, tablename, or statistics_name. Returned rows include the most_common_vals and most_common_val_nulls arrays, which contain literal sample values drawn from protected columns.

The vulnerability is described in the PostgreSQL Security Advisory. No public proof-of-concept exploit is available.

Detection Methods for CVE-2024-4317

Indicators of Compromise

Unexpected SELECT queries against pg_catalog.pg_stats_ext or pg_catalog.pg_stats_ext_exprs originating from non-administrative roles.
Repeated reads of statistics rows tied to tables the querying role lacks SELECT privilege on.
Connections from unusual client addresses or applications enumerating pg_statistic_ext catalog entries.

Detection Strategies

Enable log_statement = 'all' or pgaudit on sensitive databases and alert on queries referencing pg_stats_ext or pg_stats_ext_exprs.
Review pg_stat_activity and audit logs for low-privilege roles touching statistics catalogs outside of expected DBA tooling.
Correlate database authentication events with subsequent statistics view access to identify reconnaissance behavior.

Monitoring Recommendations

Forward PostgreSQL audit logs to a centralized analytics platform and build a rule for unauthorized statistics view reads.
Track which roles legitimately need to read extended statistics and treat all other access as anomalous.
Monitor for CREATE STATISTICS activity on tables containing regulated data so defenders know which objects are exposed by this flaw.

How to Mitigate CVE-2024-4317

Immediate Actions Required

Upgrade PostgreSQL to 16.3, 15.7, 14.12, or later on all affected instances.
For existing installations, follow the post-upgrade steps in the release notes; installing a fixed version only protects fresh clusters created with initdb after the upgrade.
Inventory all roles with LOGIN on affected databases and revoke unused accounts that could be used to query statistics views.
Audit objects protected by row-level security or column grants to assess what data may have been disclosed.

Patch Information

The PostgreSQL Global Development Group released fixed packages on May 9, 2024 in versions 16.3, 15.7, and 14.12. Refer to the PostgreSQL Security Advisory for upgrade instructions and the SQL script required to remediate existing clusters. NetApp documented affected products in NetApp Security Advisory ntap-20250328-0001.

Workarounds

If immediate patching is not possible, revoke SELECT on pg_catalog.pg_stats_ext and pg_catalog.pg_stats_ext_exprs from PUBLIC and grant it only to trusted administrative roles.
Drop unneeded extended statistics objects on tables holding sensitive data using DROP STATISTICS.
Restrict database network exposure with pg_hba.conf rules and host firewalls so only required clients can authenticate.

bash

# Configuration example: restrict access to extended statistics views
REVOKE SELECT ON pg_catalog.pg_stats_ext FROM PUBLIC;
REVOKE SELECT ON pg_catalog.pg_stats_ext_exprs FROM PUBLIC;
GRANT SELECT ON pg_catalog.pg_stats_ext TO dba_role;
GRANT SELECT ON pg_catalog.pg_stats_ext_exprs TO dba_role;