Hosted Postgres Just Got Major Hack
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: Hosted Postgres Just Got Major Hack · Channel: Better Stack · 01:01 · Watch on YouTube
Topics: Cybersecurity and software security, Data, databases and embeddings, Software engineering with AI, AI infrastructure and hardware
Summary
Section titled “Summary”A security researcher found a way to bypass a managed Postgres provider’s command blocklist by recreating a blocked function under a different name. The technique let him write a compiled library to disk, register it as a Postgres function, and execute code on the database host across all providers he tested. Superbase patched four critical issues, while other vendors were largely silent, and Postgres’s core team said providers were responsible for fixing the issue. The video clarifies that this does not expose other customers’ data, but it can provide a foothold on the provider’s infrastructure.
Key points
Section titled “Key points”- Managed Postgres providers keep superuser access for themselves and restrict customers’ access to dangerous commands.
- An extension blocked a command called allow_export by name.
- The researcher recreated the function under a different name that the blocklist did not recognize.
- He used the function to write a compiled library to disk, register it, and execute his code on the host as a Postgres system user.
- The researcher succeeded across every provider he tested.
- Superbase patched four critical issues; most other vendors went silent.
- Postgres’s core team said the issue was for providers to fix.
- The technique does not give access to other customers’ data, but it enables host code execution and a foothold on provider infrastructure.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | The managed Postgres restriction | The video explains how providers restrict superuser commands and how the blocklist targets allow_export by name. |
| 00:30 | Bypassing the blocklist | The researcher recreates the blocked function under a new name and uses it to execute code on the database host. |
| 01:01 | Impact and takeaway | The video clarifies that the exploit does not expose other customers’ data, but can provide a foothold on provider infrastructure. |
Quotes
Section titled “Quotes”they never give you superuser. — 00:00
Postgres ran his own code as a Postgres system user right on the host. — 00:30
He managed to do this successfully across every single provider he tested. — 00:30
It doesn’t hand you other customers’ data — 01:01
Concepts and entities
Section titled “Concepts and entities”PostgreSQL, Supabase, Aurora, Neon, allow_export, superuser, Better Stack
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 This security researcher just found a brand new way to hack Postgres. Let me explain. When you rent a managed Postgres like Superbase, Aurora, or Neon, they never give you superuser. The provider keeps superuser to itself and adds an extension that blocks Postgres’s most dangerous commands by name even for the most powerful role that you get. One of those blocked commands is called allow_export. It pulls data out of your database and writes it to a file anywhere on the server’s disk, but the extension only blocks it by name. So, the researcher
00:30 recreated that exact same function under a new name the blocklist had never seen before. He then used it to write a compiled library onto disk. Then, he registered that library as a function, called it, and Postgres ran his own code as a Postgres system user right on the host. He managed to do this successfully across every single provider he tested. Superbase patched four critical issues, and most other vendors just went silent. And Postgres’s own core team said this is the provider’s problem to fix, not theirs. But superuser here isn’t actually game over. It doesn’t hand you
01:01 other customers’ data, and you could already read your own instance anyway. What it really gives you is code execution on the host your database runs on and a foothold onto the provider’s infrastructure. And if you like security deep dives like this, then subscribe to Better Stack.