Is this exploitable? If it is, this is very serious and if this is an unpatched disclosure millions of Businesses around the world will be affected.

▲

mattashii 6 hours ago | parent | next [-]

Yes, once you have logged in on a primary.

▲

mdaniel 6 hours ago | parent | prev | next [-]

Isn't that only true if "millions of businesses" choose to hang their PG port out on the Internet with "allow 0/0"? In the spirit of being constructive, https://www.shodan.io/search?query=postgresql shows 516,000 which is definitely not none but pretty far from millions and based on skimming the results pretty far from the businesses part, too

	▲	insanitybit 29 minutes ago \| parent \| next [-]
		I've had people tell me that they trust postres RLS as their security boundary and that it's fine to expose.
	▲	mgiampapa 5 hours ago \| parent \| prev [-]
		I would consider it a more useful lateral movement vector inside an existing org than anything else. Lots and lots of old postgress with weak acls inside networks.

▲

InsidiousWombat 2 hours ago | parent | prev [-]

Eh, any sensible one would have DB only accessible to app that uses it