PostgreSQL Patches 12-Year Logical Decoding Flaw Letting REPLICATION Users Load Arbitrary Libraries
A 12-year-old logical decoding path allowed REPLICATION users to load arbitrary shared libraries, granting OS-level code execution. The fix introduces a server-side whitelist rather than applying existing LOAD restrictions. Operators must audit slots and update the whitelist before patching to avoid breaking replication.
The root cause is absence of path validation on the replication protocol path. The supplied plugin string reaches dlopen or LoadLibrary directly, bypassing the $libdir/plugins restriction enforced for LOAD and superuser context. On Windows an SMB path works without writing files; Linux requires NFS automount or prior write access. Cyera demonstrated escalation to superuser plus three persistence mechanisms.
Affected deployments include every CDC pipeline, logical standby, and backup tool holding the REPLICATION attribute with wal_level=logical. The new whitelist output_plugin_libraries defaults to pgoutput and test_decoding, forcing administrators to enumerate live slots before patching or lose replication.
PostgreSQL rejected retrofitting the existing LOAD check because it would have required relocating every third-party plugin. The decision leaves the replication surface permanently distinct from the SQL LOAD surface.
Post-patch, failed loads log the exact parameter name, giving defenders a clear signal. Unpatched hosts remain exposed to any credential that already holds replication rights.
PostgreSQL team: within 60 days at least 40 percent of public-facing instances will still run affected versions according to Shodan and Censys snapshots.
Sources (2)
- [1]Primary Source(https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-and-1424-released-2949/)
- [2]Supporting Source(https://cyera.com/research/postgreshell)