Protocol Message Length Overflow Vulnerability

[markmeeus]

Elixir version

Any

Database and Version

Any

Postgrex Version

Any

Current behavior

Referencing this research:
https://www.youtube.com/watch?v=Tfg1B8u1yvE

There is a possible vulnerability in clients that do not check the length of bytes before encoding the 4 length bytes in the postgres binary protocol.
This way, when a user sends data > 2^32, the 4 length bytes will overflow and allow an attacker to smuggle an extra message.
This extra message can be any valid postgres statement, and may result in serious security issues.

I checked the Postgrex code and it looks like the vulnerability might be here as well:

I found this in /messages.ex

def encode_msg(msg) do
    {first, data} = encode(msg)
    size = IO.iodata_length(data) + 4
    if first do
      [first, <<size::int32()>>, data]
    else
      [<<size::int32()>>, data]
    end
end

<size:signed-32> will overflow, but the data is not trimmed.

Expected behavior

I would expect Postgrex to raise an exception.

[wojtekmach]

Postgrex v0.19.2 is out, thank you for the report!