logoalt Hacker News

logophobia • yesterday at 9:14 PM • 3 replies • view on HN

Correct me if I'm wrong, but those all look like sql exploits. Don't those already require some sort of authenticated remote access. They are security issues, but calling them remote code exploitation make them seem more dangerous than they are.

These seem more like privilege escalation, you have access through a database account and use that to gain full access to the whole server. So an issue for multi-tenant databases mostly.


Replies

kccqzy • yesterday at 10:10 PM

You can do authentication and authorization inside sql. For example you could have something like

    CREATE ROLE initial LOGIN NOINHERIT NOCREATEDB NOCREATEROLE NOSUPERUSER;
And then you run SQL to validate any credentials and then check the database for any permissions, ending with

    SET LOCAL ROLE someuser;
It is uncommon but some people appreciate the simplicity of making the application layer do as little work as possible while pushing work into the database. It’s the logical conclusion after years of telling developers about the N+1 query problem.
➕ show 1 reply
vfosnar • yesterday at 9:26 PM

ppl host open Postgres instances, one I can think of is https://postpass.geofabrik.de/ where you can query OpenStreetMap data in a Postgres instance exposed over plain HTTP API

knorker • yesterday at 9:19 PM

It's RCE even if it's not pre-auth.