CVE-2019-9193 — AI Deep Analysis Summary

🚨 **Essence**: PostgreSQL 'COPY TO/FROM PROGRAM' feature allows OS command injection.…

🛡️ **Root Cause**: The 'COPY TO/FROM PROGRAM' command does not sufficiently sanitize input before passing it to the OS shell.…

📦 **Affected Versions**: PostgreSQL **9.3 through 11.2** (some PoCs test up to 12.3). 📌 **Component**: The database engine itself, specifically the data import/export functionality.

👑 **Privileges**: If the user has **Superuser** rights or is in the **pg_execute_server_program** group. 📂 **Data Impact**: Full Remote Code Execution (RCE).…

🔑 **Threshold**: **Medium/High**. Requires **Authentication**. You must have a valid database account with specific privileges (Superuser or specific group). It is not an unauthenticated zero-day.

💣 **Public Exp?**: **YES**. Multiple PoCs exist on GitHub (e.g., `wkjung0624`, `b4keSn4ke`). 🌐 **Wild Exploitation**: Tools like `GenPostgresRCEExploit` are available for automated exploitation.

🔍 **Self-Check**: Scan for PostgreSQL versions 9.3-11.2. 🧪 **Test**: If you have DB access, try running a `COPY ... FROM PROGRAM` command with a harmless OS command (e.g., `id`) to see if it executes.

🩹 **Official Fix**: The dev team considers it a **feature**, not a bug, so no direct patch exists for the feature itself.…

🛑 **Workaround**: **Revoke** the `pg_execute_server_program` role from users who don't strictly need it. 🚫 **Disable**: Remove execute permissions on the `COPY ... PROGRAM` command for non-superusers.

⚡ **Urgency**: **High** for misconfigured systems. If you have Superuser accounts exposed or weakly secured, this is critical. 📉 **Priority**: Patch immediately by restricting permissions or upgrading.