CVE-2024-4317

What it actually does

Missing authorization checks on the built-in views pg_stats_ext and pg_stats_ext_exprs allow any database user to retrieve most-common-value statistics and other metadata collected by CREATE STATISTICS commands issued by other users, exposing column values and function results that the querying user lacks direct read or execute privileges on.

Why it matters to the business

Attackers with minimal database access can obtain sensitive data values or infer results of privileged operations without triggering normal access controls, increasing the risk of data leakage in any long-running PostgreSQL installation that has not been manually hardened after upgrade.

How an attack unfolds

An attacker obtains a low-privileged database account, connects to the target PostgreSQL instance, and directly queries the pg_stats_ext or pg_stats_ext_exprs views to harvest most-common-value arrays and histogram data that were generated from other users' CREATE STATISTICS statements, thereby learning column contents or function outputs they are otherwise denied.

How to fix it

Upgrade to PostgreSQL 16.3, 15.7, or 14.12 (or later) and, for every existing cluster, execute the manual view-recreation steps documented in the release notes; new clusters created with initdb after installing these versions receive the fix automatically. No workaround exists other than the upgrade plus manual remediation.

How to confirm the fix worked

After upgrade and manual remediation, connect as a low-privileged user and confirm that queries against pg_stats_ext and pg_stats_ext_exprs no longer return statistics rows belonging to other users; also verify that the view definitions in the new installation match the corrected definitions published in the release notes.

Typical attack path

1. Obtain or compromise a low-privileged database user account
2. Connect to the PostgreSQL instance using that account
3. Issue SELECT statements against pg_stats_ext and pg_stats_ext_exprs
4. Parse returned most-common-value arrays and statistics to reconstruct sensitive column data or function results

How to detect it

Review database query logs and audit trails for SELECT statements targeting pg_stats_ext or pg_stats_ext_exprs issued by non-superuser roles; correlate with application connection logs to identify unexpected access patterns from low-privileged accounts.

What your security team should do

• Prioritize upgrade of all PostgreSQL 14-16 instances to the fixed minor versions and apply the documented manual view fix to existing clusters within the next change window
• Audit all database roles to ensure the principle of least privilege is followed for statistics-related objects
• Add monitoring for direct queries against pg_stats_ext and pg_stats_ext_exprs from non-superuser accounts