{"id":1538606,"date":"2025-02-14T05:17:36","date_gmt":"2025-02-14T07:17:36","guid":{"rendered":"https:\/\/teknomers.com\/fr\/vulnerabilite-postgresql-exploitee-aux-cotes-de-beyondtrust-zero-day-dans-des-attaques-ciblees\/"},"modified":"2025-02-14T05:17:41","modified_gmt":"2025-02-14T07:17:41","slug":"vulnerabilite-postgresql-exploitee-aux-cotes-de-beyondtrust-zero-day-dans-des-attaques-ciblees","status":"publish","type":"post","link":"https:\/\/teknomers.com\/fr\/vulnerabilite-postgresql-exploitee-aux-cotes-de-beyondtrust-zero-day-dans-des-attaques-ciblees\/","title":{"rendered":"Vuln\u00e9rabilit\u00e9 postgresql exploit\u00e9e aux c\u00f4t\u00e9s de Beyondtrust Zero-Day dans des attaques cibl\u00e9es"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">14 f\u00e9vrier 2025<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><\/span><span class=\"p-tags\">Zero-day \/ vuln\u00e9rabilit\u00e9<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a rel=\"nofollow\" href=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/Vulnerabilite-postgresql-exploitee-aux-cotes-de-Beyondtrust-Zero-Day-dans-des.png\" style=\"clear: left; display: block; float: left;  text-align: center;\"><\/a><\/div>\n<p>Les acteurs de la menace qui \u00e9taient \u00e0 l&#8217;origine de l&#8217;exploitation d&#8217;une vuln\u00e9rabilit\u00e9 z\u00e9ro-jour dans les produits d&#8217;acc\u00e8s \u00e0 distance privil\u00e9gi\u00e9 (PRA) et d&#8217;assistance \u00e0 distance (RS) en d\u00e9cembre 2024 ont probablement exploit\u00e9 un d\u00e9faut d&#8217;injection SQL auparavant inconnu dans Postgresql, selon les r\u00e9sultats de Rapid7.<\/p>\n<p>La vuln\u00e9rabilit\u00e9, suivie comme <strong><a rel=\"noopener nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-1094\" target=\"_blank\">CVE-2025-1094<\/a><\/strong>  (Score CVSS: 8.1), affecte l&#8217;outil interactif PostgreSQL PSQL.<\/p>\n<p>&#8220;Un attaquant qui peut g\u00e9n\u00e9rer une injection SQL via le CVE-2025-1094 peut alors atteindre l&#8217;ex\u00e9cution de code arbitraire (ACE) en tirant parti de la capacit\u00e9 de l&#8217;outil interactif \u00e0 ex\u00e9cuter des m\u00e9ta-commands&#8221;, a d\u00e9clar\u00e9 le chercheur en s\u00e9curit\u00e9 Stephen moins <a rel=\"noopener nofollow\" href=\"https:\/\/www.rapid7.com\/blog\/post\/2025\/02\/13\/cve-2025-1094-postgresql-psql-sql-injection-fixed\/\" target=\"_blank\">dit<\/a>.<\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a rel=\"nofollow noopener sponsored\" href=\"https:\/\/thehackernews.uk\/encrypted-attacks-report-d\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybers\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/Meta-confirme-lattaque-de-logiciels-spyware-zero-clique.jpg\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>La soci\u00e9t\u00e9 de cybers\u00e9curit\u00e9 a en outre not\u00e9 qu&#8217;elle avait fait la d\u00e9couverte dans le cadre de son enqu\u00eate sur CVE-2024-12356, un d\u00e9faut de s\u00e9curit\u00e9 r\u00e9cemment corrig\u00e9 dans le logiciel Beyondtrust qui permet l&#8217;ex\u00e9cution de code distant non authentifi\u00e9.<\/p>\n<p>Plus pr\u00e9cis\u00e9ment, il a constat\u00e9 que &#8220;un exploit r\u00e9ussi pour CVE-2024-12356 devait inclure l&#8217;exploitation du CVE-2025-1094 afin d&#8217;atteindre l&#8217;ex\u00e9cution du code distant&#8221;.<\/p>\n<p>Dans une divulgation coordonn\u00e9e, les responsables de PostgreSQL <a rel=\"noopener nofollow\" href=\"https:\/\/www.postgresql.org\/support\/security\/CVE-2025-1094\/\" target=\"_blank\">lib\u00e9r\u00e9<\/a> une mise \u00e0 jour pour r\u00e9soudre le probl\u00e8me dans les versions suivantes &#8211;<\/p>\n<ul>\n<li>PostgreSQL 17 (fix\u00e9 en 17.3)<\/li>\n<li>PostgreSQL 16 (fix\u00e9 en 16.7)<\/li>\n<li>PostgreSQL 15 (fix\u00e9 en 15.11)<\/li>\n<li>PostgreSQL 14 (fix\u00e9 en 14.16)<\/li>\n<li>PostgreSQL 13 (fix\u00e9 en 13.19)<\/li>\n<\/ul>\n<p>La vuln\u00e9rabilit\u00e9 d\u00e9coule de la fa\u00e7on dont PostgreSQL g\u00e8re les caract\u00e8res UTF-8 non valides, ouvrant ainsi la porte \u00e0 un sc\u00e9nario o\u00f9 un attaquant pourrait exploiter une injection SQL en utilisant un <a rel=\"noopener nofollow\" href=\"https:\/\/www.postgresql.org\/docs\/current\/app-psql.html#APP-PSQL-META-COMMAND-EXCLAMATION-MARK\" target=\"_blank\">Commande de raccourci &#8220;!&#8221;<\/a>qui permet l&#8217;ex\u00e9cution de la commande shell. <\/p>\n<div class=\"dog_two clear\"><center class=\"cf\"><a rel=\"nofollow noopener sponsored\" href=\"https:\/\/thehackernews.uk\/saas-security-v1-d\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybers\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2025\/02\/1738390842_400_Meta-confirme-lattaque-de-logiciels-spyware-zero-clique.png\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>&#8220;Un attaquant peut tirer parti du CVE-2025-1094 pour effectuer cette m\u00e9ta-command, contr\u00f4lant ainsi la commande Shell du syst\u00e8me d&#8217;exploitation qui est ex\u00e9cut\u00e9e&#8221;, a d\u00e9clar\u00e9 moins. &#8220;Alternativement, un attaquant qui peut g\u00e9n\u00e9rer une injection SQL via CVE-2025-1094 peut ex\u00e9cuter des instructions SQL contr\u00f4l\u00e9es par un attaquant arbitraire.&#8221;<\/p>\n<p>Le d\u00e9veloppement intervient alors que l&#8217;Agence am\u00e9ricaine de s\u00e9curit\u00e9 de la cybers\u00e9curit\u00e9 et des infrastructures (CISA) <a rel=\"noopener nofollow\" href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/02\/13\/cisa-adds-one-known-exploited-vulnerability-catalog\" target=\"_blank\">ajout\u00e9<\/a> Un d\u00e9faut de s\u00e9curit\u00e9 ayant un impact sur le logiciel de support \u00e0 distance SimpleHelp (CVE-2024-57727, score CVSS: 7,5) aux vuln\u00e9rabilit\u00e9s exploit\u00e9es connues (<a rel=\"noopener nofollow\" href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\">Kev<\/a>) Catalogue, obligeant les agences f\u00e9d\u00e9rales \u00e0 appliquer les correctifs d&#8217;ici le 6 mars 2025.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Vous avez trouv\u00e9 cet article int\u00e9ressant? Suivez-nous <a rel=\"noopener nofollow\" href=\"https:\/\/twitter.com\/thehackersnews\" target=\"_blank\">Gazouillement <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a>  et <a rel=\"noopener nofollow\" href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" target=\"_blank\">Liendin<\/a> Pour lire plus de contenu exclusif que nous publions.<\/div>\n<\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2025\/02\/postgresql-vulnerability-exploited.html\" rel=\"nofollow noopener\" target=\"_blank\">ttn-fr-57<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue80214 f\u00e9vrier 2025\ue804Ravie LakshmananZero-day \/ vuln\u00e9rabilit\u00e9 Les acteurs de la menace qui \u00e9taient \u00e0 l&#8217;origine de l&#8217;exploitation d&#8217;une vuln\u00e9rabilit\u00e9 z\u00e9ro-jour dans les produits d&#8217;acc\u00e8s \u00e0 distance privil\u00e9gi\u00e9 (PRA) et d&#8217;assistance \u00e0 distance (RS) en d\u00e9cembre 2024 ont probablement exploit\u00e9 un d\u00e9faut d&#8217;injection SQL auparavant inconnu dans Postgresql, selon les r\u00e9sultats de Rapid7. La vuln\u00e9rabilit\u00e9, suivie [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1538607,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[274266,274265,8074,507,268802,46619,4168,7347,79002,274264,4161,274263,6124,429,133,36372,274267,4160,57626,238617,246491,4172,79016,4166,3667,4164,35759],"class_list":["post-1538606","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-actualites-de-piratage","tag-actualites-des-pirates","tag-attaques","tag-aux","tag-beyondtrust","tag-ciblees","tag-comment-pirater","tag-cotes","tag-cyber-security-news","tag-cyber-security-news-aujourdhui","tag-cyber-mises-a-jour","tag-cyber-nouvelles","tag-cyberattaques","tag-dans","tag-des","tag-exploitee","tag-malware-ransomware","tag-mises-a-jour-de-la-cybersecurite","tag-postgresql","tag-securite-de-linformation","tag-securite-du-reseau","tag-securite-informatique","tag-the-hacker-news","tag-violation-de-donnees","tag-vulnerabilite","tag-vulnerabilite-logicielle","tag-zeroday"],"_links":{"self":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1538606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/comments?post=1538606"}],"version-history":[{"count":0,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1538606\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media\/1538607"}],"wp:attachment":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media?parent=1538606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/categories?post=1538606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/tags?post=1538606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}