Executive brief
A security vulnerability in several AWS database connection tools could allow a user with limited access to gain full administrative control over an Amazon Aurora PostgreSQL database. By creating a specially crafted function, an attacker can trick the system into executing code with the high-level permissions of other database users. This could lead to unauthorized data access, modification, or full compromise of the database environment.
Technical details
A privilege escalation vulnerability exists in multiple AWS Wrappers and the ODBC driver for Amazon Aurora PostgreSQL. The flaw allows an authenticated user with low privileges to create a crafted function that is subsequently executed with the security context and permissions of other RDS users, potentially leading to the acquisition of the rds_superuser role. This is likely related to insecure search path configurations or function execution handling within the wrappers. Attackers must have valid credentials to the database to exploit this issue. AWS recommends upgrading the affected libraries to their respective patched versions or removing the public schema from the search path as a workaround.
Affected products
- AWS JDBC Wrapper for Amazon Aurora PostgreSQL < 2.6.5
- AWS Go Wrapper for Amazon Aurora PostgreSQL < 2025-10-17
- AWS NodeJS Wrapper for Amazon Aurora PostgreSQL < 2.0.1
- AWS Python Wrapper for Amazon Aurora PostgreSQL < 1.4.0
- AWS PGSQL ODBC Driver for Amazon Aurora PostgreSQL < 1.0.1
Timeline
- 2025-11-10: advisory: Initial publication of AWS-2025-028