CVE-2024-44905 Overview
CVE-2024-44905 is a SQL injection vulnerability affecting go-pg/pg version 10.13.0, a PostgreSQL client library for the Go programming language. The flaw resides in the /types/append_value.go component, which handles value serialization when constructing SQL statements. Improper handling of untrusted input during value appending allows an attacker to smuggle SQL syntax into database queries. The issue is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Attackers who can influence values passed to the vulnerable append routine may read sensitive database contents by injecting crafted payloads that bypass query parameterization.
Affected Products
- Uptrace go-pg/pg version 10.13.0
- Applications embedding the uptrace:pg Go module for PostgreSQL access
- Downstream services relying on types/append_value.go for query value serialization
Discovery Timeline
- 2025-06-12 - CVE-2024-44905 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-44905
Vulnerability Analysis
The vulnerability exists in types/append_value.go, a component responsible for serializing Go values into SQL fragments before they are sent to the PostgreSQL server. When user-controlled data is passed through this appender without adequate neutralization, an attacker can inject additional SQL tokens into the outgoing query. This mirrors the class of protocol-level SQL smuggling issues discussed in the DEF CON 32 presentation by Paul Gerste and the SonarSource analysis of subtle SQL injection flaws. Exploitation requires user interaction, and successful attacks compromise data confidentiality without directly impacting integrity or availability.
Root Cause
The root cause is improper neutralization of special characters during value appending in types/append_value.go. Certain input sequences, including comment markers and quoting artifacts, are not fully escaped before being concatenated into the query string. Because parameter values are inlined into SQL text rather than being bound at the protocol level, malformed inputs can terminate the intended literal and introduce attacker-controlled syntax. Details of the affected code path are visible in the go-pg repository at line 151 of append_value.go.
Attack Vector
The attack vector is network-based with low complexity and no privileges required, but user interaction is needed to trigger the vulnerable code path. An attacker supplies a crafted value to an application endpoint that forwards the input to go-pg for query construction. When the appender processes the payload, injected SQL is executed against the backing PostgreSQL database, exposing query results the attacker was not authorized to view. No verified public proof-of-concept exploit is available at this time.
No verified exploit code is available. Refer to the go-pg repository for source review and the referenced research for exploitation mechanics.
Detection Methods for CVE-2024-44905
Indicators of Compromise
- PostgreSQL server logs containing unexpected comment sequences such as -- embedded within literal values passed by go-pg clients.
- Application queries with anomalous concatenated statements or unbalanced quoting originating from services that depend on uptrace:pg 10.13.0.
- Elevated volumes of SELECT statements returning columns outside the application's normal query shape.
Detection Strategies
- Perform software composition analysis to identify Go binaries and modules importing github.com/go-pg/pg at version 10.13.0.
- Enable PostgreSQL statement logging with log_statement = 'all' in non-production environments to capture query text for anomaly review.
- Instrument application code to log inputs that reach the database layer and correlate them against generated SQL text for divergence.
Monitoring Recommendations
- Monitor database error logs for syntax errors that may indicate probing of SQL injection payloads.
- Alert on database sessions issuing queries that reference tables outside the calling service's expected data domain.
- Track outbound data volume from database processes to identify potential exfiltration triggered by injected SELECT statements.
How to Mitigate CVE-2024-44905
Immediate Actions Required
- Inventory all Go services that depend on github.com/go-pg/pg version 10.13.0 and prioritize remediation for those exposed to untrusted input.
- Enforce strict server-side input validation and reject values containing SQL comment tokens or unbalanced quotes before they reach the database layer.
- Restrict PostgreSQL role privileges so that application accounts cannot read data outside their intended schemas.
Patch Information
No vendor advisory URL or fixed release is referenced in the enriched CVE data. The go-pg/pg project has been placed in maintenance mode by its authors in favor of the successor library bun. Consult the go-pg repository for the latest maintainer guidance and evaluate migration to a supported PostgreSQL client that uses server-side parameter binding.
Workarounds
- Migrate database access code to a driver that uses PostgreSQL's extended query protocol with server-side parameter binding, eliminating value inlining.
- Add an application-layer allowlist for characters permitted in fields that flow into go-pg queries, rejecting comment markers and control sequences.
- Deploy a database activity monitoring rule that blocks statements containing suspicious comment injection patterns before they reach PostgreSQL.
# Example PostgreSQL configuration to enable statement logging for detection
# Edit postgresql.conf and reload the service
log_statement = 'all'
log_min_error_statement = 'error'
log_line_prefix = '%m [%p] %q%u@%d '
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
