CVE-2024-1597

published 2024-02-19

CVE-2024-1597: pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is…

Priority P1 80 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW VulnCheck KEV

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
atlassian	bamboo	—	—
atlassian	bamboo_data_center	—	—
debian	libpgjava	< libpgjava 42.5.5-0+deb12u1 (bookworm)	libpgjava 42.5.5-0+deb12u1 (bookworm)
fedoraproject	fedora	—	—
pgjdbc	pgjdbc	< 42.7.2	42.7.2
pgjdbc	pgjdbc	< 42.6.1	42.6.1
pgjdbc	pgjdbc	< 42.5.5	42.5.5
pgjdbc	pgjdbc	< 42.4.4	42.4.4
pgjdbc	pgjdbc	< 42.3.9	42.3.9
pgjdbc	pgjdbc	< 42.2.28	42.2.28
postgresql	postgresql_jdbc_driver	< 42.2.28	42.2.28
postgresql	postgresql_jdbc_driver	>= 42.3.0 < 42.3.9	42.3.9
postgresql	postgresql_jdbc_driver	>= 42.4.0 < 42.4.4	42.4.4
postgresql	postgresql_jdbc_driver	>= 42.5.0 < 42.5.5	42.5.5
postgresql	postgresql_jdbc_driver	>= 42.6.0 < 42.6.1	42.6.1
postgresql	postgresql_jdbc_driver	>= 42.7.0 < 42.7.2	42.7.2

Detection & IOCs extracted from sources · hover to see the quote

• → Detect exploitation attempts by monitoring PostgreSQL logs for unexpected SQL commands or logic injected via application connection attempts, such as OR 1=1 patterns ↗
• → Monitor application logs for suspicious connection strings containing SQL injection payloads ↗
• → An abnormal spike in database errors related to syntax may indicate failed injection attempts ↗
• → Audit Java application dependencies for vulnerable pgjdbc versions (before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, 42.2.28) using Software Composition Analysis (SCA) tools ↗
• → Flag any JDBC connection strings that explicitly set preferQueryMode=simple, as this is the required non-default condition for exploitation ↗
• → Proof-of-concept exploits use crafted usernames such as ' a=1 ; followed by a malicious SQL query to bypass authentication ↗

• · Vulnerability is only exploitable when the non-default JDBC connection property preferQueryMode=simple is explicitly set; the default mode (extended) is not affected ↗
• · Exploitation requires a specific SQL structure: a numeric placeholder immediately preceded by a minus sign, followed by a string placeholder on the same line ↗
• · Red Hat Satellite ships the affected pgjdbc but Candlepin does not set PreferQueryMode, so the product impact is considered Low ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv 9.8 CRITICAL

vulncheck 10.0 CRITICAL

vendor_debian 10.0 CRITICAL

vendor_redhat 10.0 CRITICAL

vendor_oracle 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89