CVE-2023-32305 (SQL, published 2023-05-12T19:15Z)
Description: value: aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages missing schema qualifiers on privileged functions called by the aiven-extras extension. A low privileged user can create objects that collide with existing function names, which will then be executed instead. Exploiting this vulnerability could allow a low privileged user to acquire `superuser` privileges, which would allow full, unrestricted access to all data and database functions. And could lead to arbitrary code execution or data access on the underlying host as the `postgres` user. The issue has been patched as of version 1.1.9.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/aiven/aiven-extras
Files changed:
sql/aiven_extras.sql
Commit message: Qualify function calls with pg_catalog schema

The security definer functions `aiven_extras.pg_create_publication` and
`aiven_extras.set_pgaudit_parameter` are missing explicit `pg_catalog`
schema qualifications for array and string function calls such as
`array_length`, `format`, and `left`.

Co-authored-by: Etienne Stalmans <etienne.stalmans@aiven.io>
Co-authored-by: Kevin Michel <kevin.michel@aiven.io>
Co-authored-by: Thomas Krennwallner <teakay@aiven.io>


Vulnerable code:
    l_table_count = array_length(arg_tables, 1);
            ASSERT array_length(l_parsed_ident, 1) <= 2, 'Only simple table names or tables qualified with schema names allowed';
            IF array_length(l_parsed_ident, 1) = 2
        l_tables_command = left(l_tables_command, -2) || ' WITH (publish = %I)';
        EXECUTE format(l_tables_command, VARIADIC array[arg_publication_name] || l_parsed_arg_tables || arg_publish);
        EXECUTE format('CREATE PUBLICATION %I WITH (publish = %I)', arg_publication_name, arg_publish);
    EXECUTE format('ALTER PUBLICATION %I OWNER TO %I', arg_publication_name, session_user);
    EXECUTE format('ALTER DATABASE %I SET pgaudit.%I = %L',

Fixed code:
    l_table_count = pg_catalog.array_length(arg_tables, 1);
            ASSERT pg_catalog.array_length(l_parsed_ident, 1) <= 2, 'Only simple table names or tables qualified with schema names allowed';
            IF pg_catalog.array_length(l_parsed_ident, 1) = 2
        l_tables_command = pg_catalog.left(l_tables_command, -2) || ' WITH (publish = %I)';
        EXECUTE pg_catalog.format(l_tables_command, VARIADIC array[arg_publication_name] || l_parsed_arg_tables || arg_publish);
        EXECUTE pg_catalog.format('CREATE PUBLICATION %I WITH (publish = %I)', arg_publication_name, arg_publish);
    EXECUTE pg_catalog.format('ALTER PUBLICATION %I OWNER TO %I', arg_publication_name, session_user);
    EXECUTE pg_catalog.format('ALTER DATABASE %I SET pgaudit.%I = %L',