WS-2024-0013

Date: June 30, 2024

A logical flaw in the pg_cron extension allows low-privileged users with ownership over pg_cron's job table or ability to change the value of cron.database_name to run arbitrary SQL queries as any user including superusers. This is also possible if superuser jobs are explicitly disabled. An attacker can bypass this restriction by removing the uniqueness constraint for the primary key of pg_cron's underlying job table and inserting two jobs with the same jobId (one running as e.g. low-priv-user and the other one running as superuser). Although the superuser job is denied, it is mistakenly executed when running the first job because hte jobId is used as a reference in pg_cron's internal data structures.

Language: C