CVE-2023-22332

What it actually does

An authenticated database user can retrieve authentication credentials belonging to another database user through a flaw in Pgpool-II connection pooling logic.

Why it matters to the business

Attackers who gain initial low-privilege database access can escalate to higher-privilege accounts, enabling unauthorized data changes or service disruption across affected deployments.

How an attack unfolds

An attacker authenticates to the database using any valid user credentials, then leverages the information disclosure vulnerability in Pgpool-II to extract another user's authentication details, and subsequently uses those credentials to modify database contents or cause outages.

How to fix it

Upgrade Pgpool-II to a version that resolves the information disclosure issue in the affected series. Apply the latest patches from the vendor for the specific major version in use.

How to confirm the fix worked

Review Pgpool-II version and apply vendor-recommended updates. Monitor for any anomalous credential access patterns in database logs.

Typical attack path

1. Obtain initial database access with any valid user credentials
2. Exploit the credential disclosure flaw to retrieve target user authentication information
3. Authenticate using the obtained credentials
4. Perform unauthorized actions such as data modification or database suspension

How to detect it

Examine database and Pgpool-II logs for unusual authentication attempts or credential retrieval patterns between users.

What your security team should do

• Prioritize upgrading all Pgpool-II instances to patched versions
• Audit database user permissions to minimize credential exposure risks
• Enable enhanced logging for authentication events