PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an unauthenticated command injection flaw (CWE-77) that allows a remote attacker to inject commands that are executed as a site user. The vulnerability is network-facing with low attack complexity and requires no privileges or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), so any attacker who can reach the affected PRA/RS interface can trigger it. Successful exploitation yields arbitrary command execution in the context of the site user, with high impact ratings for confidentiality, integrity, and availability. Any organization running BeyondTrust PRA or RS — particularly where those remote-access/remote-support services are exposed to the internet — is affected; the available data does not specify affected version ranges. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-19, carries an 88% EPSS probability of exploitation within 30 days (100th percentile), and was reportedly used in the breach of the U.S. Treasury alongside a PostgreSQL vulnerability.

Do: Apply BeyondTrust's patches or vendor-specified mitigations immediately — remediation is mandatory for U.S. federal agencies under the KEV listing, and the source data does not include fixed build numbers, so confirm the correct upgrade version in BeyondTrust's security bulletin. As an interim measure, restrict or remove internet exposure of PRA/RS endpoints and hunt for signs of exploitation (unexpected commands executed as the site user), noting this flaw was used in the U.S. Treasury intrusion. If mitigations are unavailable, CISA's required action is to discontinue use of the product.

CVE-2024-57727 consists of multiple path traversal vulnerabilities (CWE-22) in SimpleHelp remote support/remote access software that affect versions 5.5.7 and earlier. Because affected request handlers do not properly validate file paths, an unauthenticated remote attacker can send crafted HTTP requests to traverse directories and download arbitrary files from the SimpleHelp server host. The attacker gains access to sensitive server configuration files containing secrets and hashed user passwords, which can support follow-on attacks such as offline password cracking and deeper compromise; ransomware operators have chained SimpleHelp flaws in double-extortion attacks, including against an MSP and its downstream customers. Any organization running SimpleHelp is affected, particularly internet-facing deployments and MSPs that use the product for remote support and access. Exploitation is confirmed in the wild: CISA added the flaw to the KEV on 2025-02-13 with known ransomware use, EPSS assigns a 95.2% probability of exploitation within 30 days, and reporting links exploitation to campaigns such as a DragonForce operator targeting an MSP and its customers and Storm-1175 ransomware activity.

Do: Upgrade all SimpleHelp servers to a patched release newer than 5.5.7 per the vendor's instructions, or apply vendor-recommended mitigations or discontinue use if patching is unavailable (the CISA KEV required action). Since the flaw exposes configuration files and hashed user passwords, rotate embedded secrets and force credential/password resets, and review SimpleHost/server access logs for unauthenticated traversal-style download requests. MSPs should check their SimpleHelp server for signs of compromise, as ransomware operators have chained these flaws to reach downstream customers.

Improper neutralization of quoting syntax (CWE-149) in PostgreSQL's libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn(), and in PostgreSQL command-line utility programs, allows SQL injection. SQL injection is triggered when an application takes attacker-influenced database input, escapes it with these functions, and uses the result to construct input passed to the psql interactive terminal; the command-line utility variant requires client_encoding BIG5 with server_encoding EUC_TW or MULE_INTERNAL. An attacker who exploits this can run arbitrary SQL, with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.1, high). All PostgreSQL releases before 17.3, 16.7, 15.11, 14.16, and 13.19 are affected across cloud and self-hosted deployments, though real-world exploitability depends on the specific usage patterns described. The flaw was exploited as a zero-day before the fixes, including in the US Treasury Department breach and in targeted attacks chained with a BeyondTrust zero-day, and EPSS puts the 30-day exploitation probability at 90%.

Do: Upgrade all PostgreSQL installations to version 17.3, 16.7, 15.11, 14.16, or 13.19 (or later). Audit application code paths that pass libpq-escaped values (PQescapeLiteral/PQescapeIdentifier/PQescapeString/PQescapeStringConn) into psql, and check any use of PostgreSQL command-line utilities where client_encoding is BIG5 and server_encoding is EUC_TW or MULE_INTERNAL. Because this flaw was chained with the BeyondTrust zero-day in targeted attacks, review the exposure of remote-access appliances and hunt for anomalous SQL/psql activity.