Rusty Pearls: Postgres RCE on Cloud Databases
Demonstrates remote code execution on managed cloud PostgreSQL databases by exploiting memory safety vulnerabilities in untrusted procedural language extensions.
Summary
Managed Cloud Database Sandboxes
Cloud service providers (such as AWS, GCP, and Azure) offer managed PostgreSQL database instances, relying on restricted user roles and system sandboxes to prevent customers from executing code on the underlying host OS.
Auditing Procedural Languages and Rust Extensions
Tal Peleg and Coby Abrams audit procedural language runtimes (such as PL/Rust) and custom PostgreSQL extensions used to execute performant code inside database engines.
Memory Corruption to Host Remote Code Execution
Subtle memory safety bugs and compiler optimization oversights in extension loaders allow attackers to escape the PostgreSQL sandbox, executing arbitrary native code with host operating system privileges.
Securing Cloud Database Services
Remediating database RCE vectors requires cloud providers to run database processes in microVM-isolated environments (like Firecracker) and enforce strict capability dropping on all extension runtimes.
Related talks
Black Hat·47 min
Presenters detail vulnerability discovery and exploitation in Security Industry Call-to-Action: We Need a Cloud Vulnerability Database.
Eye on Tech·3 min
Presenters detail vulnerability discovery and exploitation in What is a Cloud Database? Cloud vs. On-Premises Databases.
RSAC Cybersecurity·54 min
Presenters detail vulnerability discovery and exploitation in Security Industry Call-to-Action: We Need a Cloud Vulnerability Database.