Executive brief
PostgreSQL Anonymizer is an extension that helps mask sensitive data in PostgreSQL databases. The extension contains a SQL injection vulnerability in two import functions (anon.import_database_rules and anon.import_roles_rules) that allows a regular user to escalate privileges to superuser by crafting a malicious JSON file. When a superuser imports rules from the attacker-controlled file, arbitrary SQL code executes with superuser privileges, potentially granting the attacker unrestricted database access.
Technical details
PostgreSQL Anonymizer versions prior to 3.1.4 contain a SQL injection vulnerability in the to_seclabel() function, which fails to properly escape object names when interpolating them into SQL statements. An attacker can craft a JSON document with specially crafted object names containing SQL comments (--) to comment out security tokens added in version 3.1.1, breaking the previous fix. When a superuser calls anon.import_database_rules() or anon.import_roles_rules() on the malicious JSON, the injected SQL executes with superuser privileges, allowing privilege escalation. The vulnerability requires social engineering or access to influence the rules file that a superuser imports, but no direct superuser privileges. The fix is available in PostgreSQL Anonymizer 3.1.4 and later.
Affected products
- Dalibo PostgreSQL Anonymizer before 3.1.4
Timeline
- 2026-09-06: disclosed