Correct me if I'm wrong, but those all look like sql exploits. Don't those already require some sort of authenticated remote access. They are security issues, but calling them remote code exploitation make them seem more dangerous than they are.

These seem more like privilege escalation, you have access through a database account and use that to gain full access to the whole server. So an issue for multi-tenant databases mostly.

▲ kccqzy 4 hours ago | parent | next [-]

You can do authentication and authorization inside sql. For example you could have something like

    CREATE ROLE initial LOGIN NOINHERIT NOCREATEDB NOCREATEROLE NOSUPERUSER;

And then you run SQL to validate any credentials and then check the database for any permissions, ending with

    SET LOCAL ROLE someuser;

It is uncommon but some people appreciate the simplicity of making the application layer do as little work as possible while pushing work into the database. It’s the logical conclusion after years of telling developers about the N+1 query problem.

▲

somat 40 minutes ago | parent | next [-]

As an interesting thought experiment, if you do something like this and give your end users a full sql connection almost by definition you can't have a sql injection vulnerability, the database itself limits what access the clients have.

Now as to if this is actually a good idea and the database internal security is robust enough to handle full access, Well I have my doubts, It is a complicated poorly tested interface and results as disclosed by the article in question are probably not surprising.

I do run a toy application, where the experiment was to see if I could push all authentication and access control into the database, It is actually sort of neat not needing an auth layer in the application, but attacks like this were half expected.

see also: the schemaverse. A multiplayer space game where the game engine is postgres. https://github.com/Abstrct/Schemaverse

▲

mistrial9 4 hours ago | parent | prev [-]

that requires additional privelages plus login.. I agree with the pp, sensationalism

	▲	NooneAtAll5 20 minutes ago \| parent [-]
		who's pp?

▲ vfosnar 5 hours ago | parent | prev | next [-]

ppl host open Postgres instances, one I can think of is https://postpass.geofabrik.de/ where you can query OpenStreetMap data in a Postgres instance exposed over plain HTTP API

	▲	veqq 4 hours ago \| parent [-]
		Wow, that is... I would have never believed in such a thing.

▲ knorker 5 hours ago | parent | prev [-]

It's RCE even if it's not pre-auth.