CVE-2025-12967: AWS Aurora PostgreSQL Privilege Escalation

CVE-2025-12967 Overview

CVE-2025-12967 is a privilege escalation vulnerability affecting AWS Wrappers for Amazon Aurora PostgreSQL. The flaw allows a low-privilege authenticated user to craft a malicious function that could be executed with the permissions of other Amazon Relational Database Service (RDS) users, potentially escalating privileges to the rds_superuser role.

This vulnerability is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), indicating that the affected components improperly handle user-controlled input when selecting code paths or classes for execution. An attacker with basic database access could leverage this flaw to execute arbitrary operations with elevated permissions within the RDS environment.

Critical Impact

Successful exploitation enables privilege escalation to rds_superuser role, allowing attackers to execute database operations with elevated permissions, potentially compromising data integrity, confidentiality, and availability across the entire RDS instance.

Affected Products

• AWS JDBC Wrapper (versions prior to v2.6.5)
• AWS Go Wrapper (versions prior to 2025-10-17)
• AWS NodeJS Wrapper (versions prior to v2.0.1)
• AWS Python Wrapper (versions prior to v1.4.0)
• AWS PGSQL ODBC Driver (versions prior to v1.0.1)

Discovery Timeline

• 2025-11-10 - CVE-2025-12967 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-12967

Vulnerability Analysis

The vulnerability resides in the AWS wrapper libraries used to connect applications to Amazon Aurora PostgreSQL databases. These wrappers facilitate connections across multiple programming languages including Java, Go, Node.js, Python, and through ODBC drivers.

The root issue stems from improper validation when handling user-supplied input that influences function execution contexts. A low-privilege authenticated user can exploit this by creating a specially crafted function that, when executed, runs with the permissions of other RDS users rather than the originating user's limited privileges.

The attack is network-accessible and requires only low-level authentication to the database, making it particularly concerning for multi-tenant RDS deployments or environments where database access is granted to application service accounts with limited intended permissions.

Root Cause

The vulnerability is attributed to CWE-470: Use of Externally-Controlled Input to Select Classes or Code. The AWS wrapper libraries failed to properly isolate function execution contexts, allowing user-controlled input to influence which user's permissions are applied during function execution. This architectural flaw enables privilege boundary bypass within the PostgreSQL security model.

Attack Vector

The attack exploits the network-accessible database interface and requires only low-privilege authentication. An attacker with basic database access can craft a malicious function definition that manipulates the execution context to inherit permissions from higher-privileged users, including those with rds_superuser role membership.

The exploitation flow involves:

1. Authenticating to the Aurora PostgreSQL instance with a low-privilege account
2. Creating a function with specially crafted parameters or definitions
3. Triggering execution of the function in a context where it inherits elevated permissions
4. Leveraging the escalated privileges to perform unauthorized database operations

For detailed technical information about the exploitation mechanism, refer to the AWS Security Bulletin AWS-2025-028 and the associated GitHub Security Advisories.

Detection Methods for CVE-2025-12967

Indicators of Compromise

• Unusual function creation activity by low-privilege database users
• Unexpected privilege changes or role membership modifications in PostgreSQL audit logs
• Database queries or operations executed with rds_superuser permissions from accounts that should not have such access
• Anomalous patterns in pg_stat_activity showing privilege mismatches

Detection Strategies

• Enable and monitor PostgreSQL audit logging (pgaudit extension) for function creation and execution events
• Implement alerting for any privilege escalation attempts or unexpected role assignments
• Review database connection logs for wrapper library version strings to identify unpatched clients
• Monitor for creation of functions with SECURITY DEFINER attributes by non-administrative users

Monitoring Recommendations

• Configure CloudWatch alarms for unusual database activity patterns in RDS Performance Insights
• Establish baseline metrics for function creation and modification events
• Implement real-time monitoring of rds_superuser role usage and track all operations performed under this context
• Deploy database activity monitoring solutions to detect privilege escalation attempts

How to Mitigate CVE-2025-12967

Immediate Actions Required

• Upgrade all AWS wrapper libraries to the patched versions immediately
• Audit all database users and their current role memberships for unauthorized changes
• Review recently created functions for potentially malicious code
• Temporarily restrict function creation privileges for non-administrative users if patching cannot be immediately performed

Patch Information

AWS has released patched versions of all affected wrapper libraries. Organizations should upgrade to the following versions:

Additional security advisories are available for each component: JDBC Advisory, Go Advisory, NodeJS Advisory, Python Advisory, ODBC Advisory.

Workarounds

• Revoke CREATE FUNCTION privileges from untrusted or low-privilege database users until patching is complete
• Implement strict network segmentation to limit database access to authorized application servers only
• Use IAM database authentication with fine-grained permissions to reduce the attack surface
• Enable PostgreSQL row-level security (RLS) policies to limit data access regardless of privilege escalation

# Revoke function creation from public schema for untrusted users
psql -h your-aurora-endpoint -U admin -d your_database -c "REVOKE CREATE ON SCHEMA public FROM PUBLIC;"

# Audit existing functions created by non-admin users
psql -h your-aurora-endpoint -U admin -d your_database -c "SELECT proname, proowner::regrole, prosecdef FROM pg_proc WHERE proowner NOT IN (SELECT oid FROM pg_roles WHERE rolsuper OR rolname = 'rds_superuser');"