From: emad al-mousa <emadalmousa2002@yahoo.com>
To: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: DoS Vulnerability
Date: Tue, 14 May 2024 16:18:15 +0000 (UTC)
Message-ID: <2011067370.2392963.1715703495829@mail.yahoo.com> (raw)
References: <2011067370.2392963.1715703495829.ref@mail.yahoo.com>
Hello,
In the documentation: 5.7. Privileges
| | |
5.7. Privileges
|
“For other types of objects, the default privileges granted to PUBLIC are as follows: CONNECT and TEMPORARY (create temporary tables) privileges for databases; EXECUTE privilege for functions and procedures; and USAGE privilege for languages and data types (including domains). The object owner can, of course, REVOKE both default and expressly granted privileges. (For maximum security, issue the REVOKE in the same transaction that creates the object; then there is no window in which another user can use the object.)”
by default any role/user in postgresql can connect to "ANY" database in the cluster so even though the account can only connect, the account can still create temporary object (for example temporary table). This table will be created in the default database tablespace of the database associated with...it will consume the space until it exhausts it....this means an application performing bulk write will face problems inserting data. keeping connect permission by default granted to PUBLIC in PostgreSQL is opening a wide security hole that shouldn't exist in the first. I strongly believe this should be patched and connect permission should be revoked from PUBLIC in all databases and template1 database (the base database where DB's are created based on)
account donald who is defined in pg_hba.conf file to authenticate against postgres database as shown below, will be able t connect to "odsdb" database and exhaust tablespace and cause Denial Of Service.
$ /usr/pgsql-15/bin/psql -h localhost -U donald -d postgres -WPassword:psql (15.6)SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)Type "help" for help.
postgres=> \c odsdbPassword:SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)You are now connected to database "odsdb" as user "donald".odsdb=> create temporary table tempo as select * from generate_series(1,1000000000000000000000000000000000000);ERROR: could not write to file "pg_tblspc/16389/PG_15_202209061/pgsql_tmp/pgsql_tmp7557.7": No space left on device
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: emadalmousa2002@yahoo.com, pgsql-bugs@lists.postgresql.org
Subject: Re: DoS Vulnerability
In-Reply-To: <2011067370.2392963.1715703495829@mail.yahoo.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox