A high-severity privilege escalation vulnerability in DALIBO PostgreSQL Anonymizer allows authenticated users to gain superuser privileges, posing a critical risk to database integrity.

This flaw involves an uncontrolled search path element where the anon.get_tablesample_ratio function executes malicious code with elevated privileges. The vulnerability requires the attacker to have CREATE privileges, which are granted by default in certain configurations, particularly on instances upgraded from PostgreSQL 14 or earlier.

Successful exploitation allows an attacker to gain full superuser control over the database instance. Given the CVSS score of 8.0, this represents a high-risk scenario where an attacker could bypass all security controls, leading to total data compromise, unauthorized modification of sensitive information, or complete system takeover.

Immediate Action: Update the PostgreSQL Anonymizer extension to version 3.0.1 or later to apply the necessary security patches.

Proactive Monitoring: Review database logs for suspicious use of the CREATE command or unexpected calls to the anon.get_tablesample_ratio function.

Compensating Controls: Restrict CREATE privileges on the public schema and critical databases to only trusted, verified user accounts to limit the attack surface.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk to database security by enabling unauthorized privilege escalation. Organizations should prioritize updating the PostgreSQL Anonymizer extension to version 3.0.1 immediately to eliminate the underlying flaw and prevent potential compromise by malicious actors.