CVE-2024-45624

What it actually does

The flaw allows a database user to retrieve table data from the query cache that they are not authorized to access because of incompatible policies between query caching and access controls.

Why it matters to the business

Organizations risk unauthorized exposure of sensitive database contents, increasing the chance of data breaches, compliance failures, and loss of confidentiality; the issue affects Go-based in-toto deployments with low but stable exploit probability and no known ransomware or KEV activity.

How an attack unfolds

An attacker with legitimate database access issues queries that populate or hit the query cache, exploiting the policy incompatibility to bypass authorization and read restricted table rows.

How to fix it

Upgrade github.com/in-toto/in-toto-golang to version 0.3.0 or later; apply equivalent policy and cache fixes to Pgpool-II deployments if present in the environment.

How to confirm the fix worked

Confirm the deployed in-toto-golang version is at least 0.3.0, re-test cache queries with varying authorization levels to ensure no cross-user data leakage, and review access policy configurations.

Typical attack path

1. Obtain valid database user credentials
2. Submit queries designed to engage the query cache
3. Retrieve cached rows that exceed the user's authorization
4. Exfiltrate the exposed sensitive information

How to detect it

Examine database and application logs for queries that return cached results across authorization boundaries; look for patterns of repeated cache access by low-privilege accounts that later correlate with unexpected data exposure.

What your security team should do

• Immediately upgrade all instances of in-toto-golang to the fixed 0.3.0 release
• Audit database query cache and authorization policy alignment
• Enable enhanced logging of cache hits for privileged data
• Monitor EPSS and threat intelligence for any future increase in exploit activity