Rusty pearls: Postgres RCE on cloud databases

The talk covers CVE-2024-10979, a PostgreSQL flaw found by Varonis Threat Labs researchers while they examined what an administrative user on a managed cloud database could reach. Managed services such as AWS RDS give customers an admin role that is not a true superuser, so the question was whether that boundary could be crossed. The speakers explain how trusted procedural languages are meant to restrict access to the underlying host.

The core issue is that the trusted PL/Perl language let a user change process environment variables through a Perl internal hash, something only untrusted languages should allow. PL/Rust compiles functions by invoking cargo, so the altered variables could redirect the build to a chosen binary and inject shell commands through a wrapper script. The researchers describe how they searched open-source extension code for process-launching calls, and why PostgreSQL's process API kept the changed environment from reaching child processes. A short test on a live RDS instance was heavily constrained, and AWS's incident response team responded quickly.

The takeaways are practical: keep minor versions patched, restrict who can create functions and extensions, and use an allow list for loadable extensions. The speakers also argue that managed database backends deserve responsible community research, and that researchers should coordinate with the provider before testing on production cloud services.