CVE-2017-15099 in PostgreSQL
Summary
by MITRE
INSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10 disclose table contents that the invoker lacks privilege to read. These exploits affect only tables where the attacker lacks full read access but has both INSERT and UPDATE privileges. Exploits bypass row level security policies and lack of SELECT privilege.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/02/2025
This vulnerability in PostgreSQL represents a significant privilege escalation issue that undermines the database's access control mechanisms. The flaw exists in the implementation of the INSERT ... ON CONFLICT DO UPDATE command, which allows attackers to extract data from tables they cannot normally access through standard SELECT operations. The vulnerability affects multiple major versions including 10.x before 10.1, 9.6.x before 9.6.6, and 9.5.x before 9.5.10, indicating a widespread impact across the PostgreSQL ecosystem. The technical nature of this flaw stems from how PostgreSQL handles privilege checks during conflict resolution operations, specifically when the database engine attempts to determine what data should be updated during a conflict scenario. This vulnerability directly relates to CWE-284 which addresses inadequate access control mechanisms, and more specifically maps to CWE-1234 which deals with insecure privilege management in database systems.
The operational impact of this vulnerability is severe as it enables attackers with limited privileges to bypass row level security policies and extract sensitive data from tables they should not be able to read. An attacker who possesses both INSERT and UPDATE privileges but lacks SELECT access can exploit this flaw to reconstruct table contents through carefully crafted INSERT ... ON CONFLICT DO UPDATE statements. The vulnerability operates by leveraging the database's internal mechanisms for handling conflicts during insert operations, where the system inadvertently exposes data that would normally be protected by row level security policies. This creates a scenario where privilege boundaries are effectively circumvented, allowing for unauthorized data disclosure that could include personally identifiable information, financial records, or other sensitive business data. The attack vector is particularly concerning because it can be executed without requiring direct SELECT privileges, making it difficult to detect through traditional monitoring approaches.
The exploitation of this vulnerability demonstrates a fundamental flaw in PostgreSQL's privilege validation system during conflict resolution operations. When an attacker issues an INSERT ... ON CONFLICT DO UPDATE command, the database engine performs internal checks to determine if the operation should proceed, but these checks fail to properly enforce the security boundaries that should prevent data disclosure. The flaw specifically affects scenarios where row level security is enabled, as the system's conflict resolution process does not adequately validate that the user has appropriate access to the data being updated. This vulnerability aligns with ATT&CK technique T1078 which covers valid accounts and T1566 which covers credential access through exploitation of database vulnerabilities. Organizations running affected PostgreSQL versions should immediately apply the relevant security patches to address this issue, as the vulnerability can be exploited by any user with INSERT and UPDATE privileges but without SELECT access to the target tables. The mitigation strategy involves upgrading to patched versions of PostgreSQL, but administrators should also review their database access controls and implement additional monitoring to detect potential exploitation attempts.