SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud
Paul Gerste, Moritz Sanft
OffensiveCon 2026 · Day 2 · Main Stage
This talk, "SELECT shell FROM postgres: Digging up a 20-year-old bug for ZeroDay.Cloud," presented by Paul Gerste and Moritz Sanft, details their successful exploit of a two-decade-old vulnerability in **PostgreSQL** that led to remote code execution (RCE) as a low-privileged user. The researchers uncovered a critical flaw within the **PG crypto** extension, specifically in its **PGP sym_decrypt** function, which allowed for the injection of arbitrary bytes into the database, bypassing fundamental encoding checks. This seemingly innocuous primitive was then leveraged through a sophisticated chain of memory corruption techniques to achieve a full compromise of the database server.
AI review
A textbook-quality exploit chain rooted in a 20-year-old encoding bug in pgcrypto — dirty string injection to length confusion to controlled heap corruption to arbitrary write to RCE as postgres user, all from a low-privileged post-auth position. This is exactly the kind of research that makes conference programs worth attending: novel primitive discovery, clean chain construction, real-world impact on managed cloud databases, and a live shell to close it out.