CVE-2019-9193: OS Command Injection
DISPUTED In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.
Other sources
PostgreSQL could allow a local authenticated attacker to execute arbitrary code on the system, caused by a flaw in the COPY TO/FROM PROGRAM function. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of the database's operating system user.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-9193?
CVE-2019-9193 is a vulnerability in PostgreSQL where the "COPY TO/FROM PROGRAM" function allows authenticated attackers to execute arbitrary code on the system.
How severe is CVE-2019-9193?
CVE-2019-9193 has a severity score of 7.2 (critical).
Which software versions are affected by CVE-2019-9193?
PostgreSQL versions 9.3 through 11.2 are affected by CVE-2019-9193. Additionally, IBM Security Verify Governance version 10.0 is also affected.
How can an attacker exploit CVE-2019-9193?
By using the "COPY TO/FROM PROGRAM" function, superusers and users in the 'pg_execute_server_program' group can execute arbitrary code in the context of the database's operating system user.
Are there any references for CVE-2019-9193?
Yes, you can find references for CVE-2019-9193 at the following links: [1](http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html), [2](http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html), [3](http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html)