CVE-2019-9193
84Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 92%
from disclosure to weapon37 days
Published on NVDApr 1
1st PoC+37d
metasploitMar 20
VulnCheck+662d
exploitation probability
92%top 1% of all CVEs
observed exploitation
yesVulnCheck
22 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
8 products (105 components) — because the vulnerable code is not present in the product
Red Hat Software Collections · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7 · CloudForms Management Engine 5 · Red Hat Enterprise Linux 6 · and others 3
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.
Affected products
n/a · n/apublic PoCs found — 22✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46813githubgithub.com/b4keSn4ke/CVE-2019-9193★ 21githubgithub.com/geniuszly/CVE-2019-9193★ 4githubgithub.com/wkjung0624/cve-2019-9193★ 3githubgithub.com/paulotrindadec/CVE-2019-9193★ 1githubgithub.com/netw0rk7/CVE-2019-9193-Home-Lab★ 0githubgithub.com/CybersRMUTL/CVE-2019-9193-Postgresql-RCE★ 0githubgithub.com/corsisechero/CVE-2019-9193byVulHub★ 0githubgithub.com/jhnhnck/CVE-2019-9193★ 0vulncheckvulncheck.com/xdb/18caab4f43c9unverifiedvulncheckvulncheck.com/xdb/acb3ad6082cbunverifiedcve_referencepacketstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/7917b63fa40funverifiedvulncheckvulncheck.com/xdb/6272649d9a3bunverifiedvulncheckvulncheck.com/xdb/3bde608f037cunverifiedvulncheckvulncheck.com/xdb/7163ff91f6bbunverifiedvulncheckvulncheck.com/xdb/e86cc1c8300aunverifiedvulncheckvulncheck.com/xdb/ae385be7fbf9unverifiedvulncheckvulncheck.com/xdb/d49085c8a0deunverifiedcve_referencepacketstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/1736beb5bce4unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.htmlhttp://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.htmlhttps://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/https://security.netapp.com/advisory/ntap-20190502-0003/https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/