CVE-2025–1094: PostgreSQL SQL Injection Vulnerability

CVE-2025–1094 is a high-severity SQL injection vulnerability affecting PostgreSQL, discovered by Rapid7 researcher Stephen Fewer and patched on February 13, 2025. Here’s a detailed breakdown:

Vulnerability Overview

Root Cause: Improper neutralization of quoting syntax in PostgreSQL’s libpq functions (PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn()), allowing SQL injection in specific scenarios.

Exploitable Conditions:

• When escaped input from these functions is used to construct commands for psql (PostgreSQL’s interactive terminal).
• When command-line arguments are processed with mismatched encodings (client_encoding=BIG5 and server_encoding=EUC_TW or MULE_INTERNAL)

Impact

• Arbitrary Code Execution (ACE): Attackers can exploit SQL injection to execute OS commands via psql’s meta-commands (e.g., \! followed by shell commands).
• Arbitrary SQL Execution: Malicious SQL statements can be injected to manipulate databases.

Affected Versions

• All versions of PostgreSQL before 17.3
• All versions of PostgreSQL before 16.7
• All versions of PostgreSQL before 15.11
• All versions of PostgreSQL before 14.16
• All versions of PostgreSQL before 13.19

Remediation

• Upgrade PostgreSQL: Apply patches for the affected versions

Reference link: https://www.postgresql.org/support/security/CVE-2025-1094/

Mitigation and Best Practices:

1. Validate UTF-8 encoding: Reject inputs containing invalid UTF-8 sequences before passing to psql.
2. Use Parameterized Queries: Use parameterized queries or ORM frameworks to minimize direct psql usage with raw input.
3. Restrict psql privileges: Limit OS-level permissions for the PostgreSQL user to reduce RCE impact.
4. Monitor logs: Flag repeated invalid byte sequence for encoding “UTF8” errors, which may indicate exploitation attempts.

References:

https://nvd.nist.gov/vuln/detail/CVE-2025-1094

https://www.postgresql.org/support/security/CVE-2025-1094/

https://access.redhat.com/security/cve/cve-2025-1094

https://www.enterprisedb.com/docs/security/assessments/cve-2025-1094/