Description

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-06T16:16:50.603Z",
  "pubdate": "2026-09-06T16:16:50.603Z",
  "executiveSummary": "PostgreSQL Anonymizer is susceptible to an SQL injection vulnerability arising from improper sanitization of object names within JSON configuration files. This flaw affects the 'anon.import_database_rules()' and 'anon.import_roles_rules()' functions. By crafting a malicious JSON document, an attacker can inject arbitrary SQL commands that execute with the privileges of the superuser invoking the import function. The vulnerability poses a critical risk to data integrity, confidentiality, and system availability, as successful exploitation allows for full administrative control over the PostgreSQL instance. The issue is resolved in version 3.1.4 and subsequent releases. It is imperative that organizations utilizing affected versions of PostgreSQL Anonymizer upgrade immediately to mitigate the risk of unauthorized code execution.",
  "technicalDetails": "The root cause of this vulnerability lies in the unsafe processing of JSON-formatted rulesets within the PostgreSQL Anonymizer extension. Specifically, the functions 'anon.import_database_rules()' and 'anon.import_roles_rules()' fail to adequately sanitize object names defined within the provided JSON document before incorporating them into internal SQL statements.\nThe exploitation flow begins when an attacker prepares a specially crafted JSON object. By embedding malicious SQL payloads within the object name fields of this document, an attacker can manipulate the generated dynamic SQL queries. When a superuser performs an import operation using this compromised JSON, the database engine executes the injected SQL strings as part of the ruleset processing logic.\nBecause the import functions are typically executed by a superuser to apply anonymization rules across the database, the injected payload inherits these elevated privileges. This allows the attacker to execute arbitrary commands, potentially leading to unauthorized data extraction, modification of database objects, or total compromise of the underlying server infrastructure.\nAffected versions include all releases of PostgreSQL Anonymizer prior to version 3.1.4. The vulnerability does not require remote network access in the traditional sense; rather, it requires the attacker to influence or provide the JSON input files consumed by the privileged user during the administrative import process. The lack of parameterized queries or strict input validation on the object names allows the attacker to break out of the intended context, effectively performing a classic second-order SQL injection.\nPost-exploitation impact is severe, as the attacker achieves arbitrary command execution with superuser rights. This facilitates persistence, data exfiltration, and the ability to circumvent any security controls defined within the PostgreSQL instance. Remediation requires upgrading to version 3.1.4 or higher, which introduces the necessary sanitization logic to neutralize malicious object name payloads before they are parsed into executable queries."
}