pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs the relocation with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, bypassing the authorization check that a normal ALTER TABLE SET SCHEMA operation would enforce.
This permits unauthorized relocation of retained child tables between schemas. This issue is fixed in version 5.5.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/pgpartman/pg_partman/commit/ba9405542acf24dd881845b935cab8b1…
security-advisories@github.com
https://github.com/pgpartman/pg_partman/releases/tag/v5.5.0
security-advisories@github.com
https://github.com/pgpartman/pg_partman/security/advisories/GHSA-pxp2-x8cf-rfhc
security-advisories@github.com