{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apostgresqlpostgresql/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2019-9193"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PostgreSQL"],"_cs_severities":["high"],"_cs_tags":["postgresql","execution","network-security"],"_cs_type":"advisory","_cs_vendors":["PostgreSQL"],"content_html":"\u003cp\u003eThe PostgreSQL database management system supports the \u003ccode\u003eCOPY ... FROM PROGRAM\u003c/code\u003e and \u003ccode\u003eCOPY ... TO PROGRAM\u003c/code\u003e SQL commands, which allow the database to interact directly with the underlying host operating system. While intended for administrative data-processing tasks such as importing or exporting files, this functionality provides an avenue for command execution when accessed by a superuser or a role possessing the \u003ccode\u003epg_execute_server_program\u003c/code\u003e privilege.\u003c/p\u003e\n\u003cp\u003eThreat actors who successfully obtain privileged database credentials often exploit this feature to bypass typical application-layer restrictions. By initiating a \u003ccode\u003eCOPY\u003c/code\u003e statement containing the \u003ccode\u003ePROGRAM\u003c/code\u003e keyword, attackers can spawn shells (e.g., \u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003esh\u003c/code\u003e), execute downloaders (\u003ccode\u003ecurl\u003c/code\u003e, \u003ccode\u003ewget\u003c/code\u003e), or run malicious payloads like cryptominers directly within the security context of the PostgreSQL service account. This technique is well-documented in various post-compromise scenarios, including widespread automated cryptomining campaigns that target exposed or weakly protected database instances. Defenders should monitor database query traffic for the presence of the \u003ccode\u003ePROGRAM\u003c/code\u003e keyword within \u003ccode\u003eCOPY\u003c/code\u003e statements to detect unauthorized process execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to the database using compromised or brute-forced superuser credentials.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the database as a target for persistence or resource exploitation (e.g., cryptomining).\u003c/li\u003e\n\u003cli\u003eThe attacker issues a \u003ccode\u003eCOPY ... FROM PROGRAM\u003c/code\u003e or \u003ccode\u003eCOPY ... TO PROGRAM\u003c/code\u003e SQL statement via an active database session.\u003c/li\u003e\n\u003cli\u003eThe PostgreSQL process engine parses the \u003ccode\u003ePROGRAM\u003c/code\u003e keyword and invokes the specified command through an OS shell.\u003c/li\u003e\n\u003cli\u003eThe OS shell executes the attacker's payload (e.g., a shell script or binary) using the privileges of the \u003ccode\u003epostgres\u003c/code\u003e service account.\u003c/li\u003e\n\u003cli\u003eThe payload performs subsequent malicious actions, such as establishing a reverse shell, downloading additional malware, or initiating cryptomining processes.\u003c/li\u003e\n\u003cli\u003eThe attacker maintains persistence by leveraging the shell access to install backdoors or scheduled tasks on the underlying host.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the database server, leading to potential data exfiltration, ransomware deployment, or long-term resource hijacking for cryptomining. These campaigns can impact any organization running PostgreSQL where database access controls are insufficient or where the \u003ccode\u003epg_execute_server_program\u003c/code\u003e privilege is assigned to non-administrative service accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor network query logs for any \u003ccode\u003eCOPY\u003c/code\u003e SQL statement containing the \u003ccode\u003ePROGRAM\u003c/code\u003e keyword using the provided Sigma rule.\u003c/li\u003e\n\u003cli\u003eAudit database roles to ensure that \u003ccode\u003epg_execute_server_program\u003c/code\u003e privileges are restricted strictly to authorized administrative accounts.\u003c/li\u003e\n\u003cli\u003eImplement endpoint process monitoring to detect the PostgreSQL service account spawning unauthorized child processes such as \u003ccode\u003esh\u003c/code\u003e, \u003ccode\u003ebash\u003c/code\u003e, \u003ccode\u003ecurl\u003c/code\u003e, \u003ccode\u003ewget\u003c/code\u003e, or cryptomining binaries.\u003c/li\u003e\n\u003cli\u003eReview PostgreSQL audit logs and network traffic for suspicious database activity, including unusual enumeration or unexpected queries following successful authentication.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect potentially malicious \u003ccode\u003eCOPY\u003c/code\u003e statements in network telemetry.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-07T15:16:44Z","date_published":"2026-07-31T19:10:28Z","id":"https://feed.craftedsignal.io/briefs/2026-07-postgresql-copy-program/","summary":"The PostgreSQL 'COPY ... PROGRAM' feature enables users with elevated privileges to execute arbitrary operating-system commands, a technique frequently abused by attackers to deploy cryptominers or establish persistence.","title":"PostgreSQL COPY PROGRAM Command Execution","url":"https://feed.craftedsignal.io/briefs/2026-07-postgresql-copy-program/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}