CVE-2024-4545: EPAS Authorization Bypass Vulnerability

CVE-2024-4545 Overview

CVE-2024-4545 is an authorization bypass vulnerability in EnterpriseDB Postgres Advanced Server (EPAS). The flaw affects all versions from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0. Users invoking edbldr can bypass role permissions enforced by pg_read_server_files. Low privilege database users can read server-side files they should not otherwise access, resulting in unauthorized information disclosure. The vulnerability is classified under CWE-269: Improper Privilege Management.

Critical Impact
Authenticated low-privilege users can bypass pg_read_server_files role restrictions through edbldr and read arbitrary files accessible to the database server process.

Affected Products

EnterpriseDB Postgres Advanced Server (EPAS) 15.0 through versions prior to 15.7.0
EnterpriseDB Postgres Advanced Server (EPAS) 16.0 through versions prior to 16.3.0
Deployments using the edbldr bulk loader utility

Discovery Timeline

2024-05-14 - CVE-2024-4545 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4545

Vulnerability Analysis

The vulnerability resides in the edbldr utility, EnterpriseDB's implementation of an Oracle SQL*Loader-compatible bulk data loader. edbldr reads control files and data files from the server file system to load data into database tables. In a properly enforced authorization model, only roles granted pg_read_server_files should read arbitrary server-side files.

EPAS versions 15.0 to 15.7.0 and 16.0 to 16.3.0 fail to enforce this role check within the edbldr code path. A user without membership in pg_read_server_files can invoke edbldr and cause the server to open, parse, and return content from files on the database host. This breaks the confidentiality boundary that PostgreSQL-derived servers establish between database roles and host filesystem access.

Root Cause

The root cause is missing role-based authorization checks in the edbldr file-handling routines. The utility inherits the file-system privileges of the PostgreSQL server process, which typically runs as the postgres operating-system user. Without validating that the calling role holds pg_read_server_files, edbldr allows any authenticated database user to leverage server-level filesystem privileges. This falls under CWE-269: Improper Privilege Management.

Attack Vector

Exploitation requires an authenticated low-privilege database session with permission to execute edbldr. The attacker crafts an edbldr invocation referencing a target file path readable by the database server operating-system account. The server reads the file and returns its contents to the session, bypassing the pg_read_server_files role gate. Sensitive targets include PostgreSQL configuration files, private keys, credential files, application secrets, and cluster data files. The scope changes because the vulnerable component grants access to resources beyond the database engine's normal role boundary. Refer to the EnterpriseDB Security Advisory CVE-2024-4545 for vendor technical detail.

Detection Methods for CVE-2024-4545

Indicators of Compromise

edbldr invocations originating from database roles that are not members of pg_read_server_files.
PostgreSQL log entries showing file reads targeting sensitive paths such as /etc/passwd, postgresql.conf, pg_hba.conf, or key material.
Unusual data-loader activity from application service accounts that historically do not perform bulk loads.

Detection Strategies

Enable log_statement = 'all' on EPAS instances and alert on edbldr command execution by non-privileged roles.
Audit pg_stat_activity and connection logs for sessions that invoke bulk-loading routines outside of scheduled ETL windows.
Compare role membership in pg_read_server_files against the set of users observed calling edbldr in query logs.

Monitoring Recommendations

Forward EPAS server logs to a centralized logging or SIEM platform for correlation with authentication events.
Monitor filesystem access on the database host for reads of sensitive files by the PostgreSQL service account outside normal operations.
Establish a baseline of legitimate edbldr usage and alert on deviations in caller identity, source host, or file path.

How to Mitigate CVE-2024-4545

Immediate Actions Required

Upgrade EPAS 15.x deployments to version 15.7.0 or later.
Upgrade EPAS 16.x deployments to version 16.3.0 or later.
Review and revoke edbldr execution permission from roles that do not require bulk-loading functionality.
Rotate any credentials or key material stored in files that may have been exposed prior to patching.

Patch Information

EnterpriseDB has released fixed versions 15.7.0 and 16.3.0 that enforce the pg_read_server_files role check within edbldr. Consult the EnterpriseDB EPAS 15 Release Notes and the EnterpriseDB Latest EPAS Release Notes for upgrade procedures. The EnterpriseDB Security Advisory CVE-2024-4545 documents the vendor's remediation.

Workarounds

Restrict database logins so that only trusted administrative roles can execute edbldr until the patch is applied.
Run the EPAS service under an operating-system account with the minimum filesystem permissions required, limiting the scope of any successful bypass.
Enforce network access controls that restrict direct database connectivity to trusted application hosts and administrators.

bash

# Example: revoke edbldr execution from a specific role until patched
REVOKE EXECUTE ON PROCEDURE edbldr FROM low_priv_role;

# Verify pg_read_server_files membership
SELECT rolname FROM pg_roles r
JOIN pg_auth_members m ON m.member = r.oid
JOIN pg_roles g ON g.oid = m.roleid
WHERE g.rolname = 'pg_read_server_files';