26
Coverage of 26 from the conference program.
Summary
Overview: Paul (PSPaul) of Sonar and Moritz of Edgeless Systems present at OffensiveCon on exploiting a 20-year-old PostgreSQL bug discovered through the zeroday.cloud event.
Key Topics: The zeroday.cloud vulnerability research event; PostgreSQL architecture background; virtual function pointer exploitation primitives; low-privileged user to RCE escalation paths; and responsible disclosure processes.
Technical Details: Researchers demonstrate building exploitation primitives on a long-standing PostgreSQL bug, showing how default non-superuser permissions can be leveraged. Superuser access provides trivial RCE via COPY FROM PROGRAM, but the talk focuses on elevation from limited privileges.
Takeaways: Even mature open-source databases harbor decades-old vulnerabilities. Coordinated disclosure events like zeroday.cloud accelerate discovery of overlooked security flaws.
