4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-10978

CVE-2024-10978: Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or...

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses parameters from the attacker or conveys query results to the attacker. If that query reacts to current_setting('role') or the current user ID, it may modify or return data as though the session had not used SET ROLE or SET SESSION AUTHORIZATION. The attacker does not control which incorrect user ID applies. Query text from less-privileged sources is not a concern here, because SET ROLE and SET SESSION AUTHORIZATION are not sandboxes for unvetted queries. Versions before PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 are affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-10978

CVE-2024-10978:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2024-10978) concerns incorrect privilege assignment when PostgreSQL applications use SET ROLE or SET SESSION AUTHORIZATION. Queries reacting to current_setting('role') or the current user ID could then operate with incorrect privileges. The provided commit a5d2e6205 directly addresses these issues. The analysis focused on functions modified by this patch that are responsible for setting, managing, or initializing user IDs, roles, and session authorization contexts.

Key areas of change in the patch include:

miscinit.c: Functions like SetSessionAuthorization, SetCurrentRoleId, and InitializeSessionUserId were modified to correctly manage the session's user/role state and their interactions, particularly how they update underlying user ID variables and GUCs like is_superuser.
parallel.c: ParallelWorkerMain was updated to explicitly set all relevant user ID and role states at the beginning of worker initialization, ensuring parallel workers adopt the correct security context from the leader.
guc.c: set_config_option_ext was modified with a specific hack to enforce that SET SESSION AUTHORIZATION also implies SET ROLE NONE, addressing a fundamental issue in how these GUCs interacted.
variable.c: Check functions like check_session_authorization and check_role were updated to correctly handle states during parallel worker initialization and ensure proper privilege checks.

The identified functions are those whose flawed logic or interaction directly led to the incorrect privilege states described in the CVE. The patch rectifies these flaws by ensuring more robust state management and correct propagation of security contexts, especially across transaction boundaries and into parallel workers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.