{"id":34018,"date":"2025-05-01T06:16:30","date_gmt":"2025-05-01T06:16:30","guid":{"rendered":""},"modified":"2025-05-19T23:21:05","modified_gmt":"2025-05-19T23:21:05","slug":"cve-2025-2291-expired-passwords-remain-usable-in-pgbouncer","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-2291-expired-passwords-remain-usable-in-pgbouncer\/","title":{"rendered":"CVE-2025-2291: Expired Passwords Remain Usable in PgBouncer<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The recently identified vulnerability, CVE-2025-2291, poses a significant risk to systems utilizing the PgBouncer software. This vulnerability allows an attacker to log into a system with an already expired password. This is due to the auth_query functionality not considering the VALID UNTIL value from Postgres. As a result, systems that rely on PgBouncer for connection pooling are at risk of unauthorized access and data<\/a> leakage.
\nThis vulnerability is of critical<\/a> concern to organizations that have integrated PgBouncer into their PostgreSQL deployments. If exploited, it could lead to system compromise and potential<\/a> data leakage, which could have severe consequences on the integrity and confidentiality of the system data.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-2291
\nSeverity: Critical (8.1 CVSS score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise and potential<\/a> data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

PgBouncer | All versions prior<\/a> to the patch<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of the fact that PgBouncer’s auth_query does not factor in the VALID UNTIL value from Postgres. As a result, when a password expires, PgBouncer continues to accept it as a valid credential. This allows an attacker to use an expired password<\/a> to gain unauthorized access to the system.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of how the vulnerability might be exploited:<\/p>\n

-- Assume that 'userA' has an expired password\nSELECT * FROM pg_shadow WHERE usename = 'userA' AND valuntil < CURRENT_TIMESTAMP;\n-- If the above query returns a result, it means the password is expired but still usable in PgBouncer<\/code><\/pre>\n
In the above example, an attacker can attempt to log in as 'userA' using the expired password. If the system has the CVE-2025-2291 vulnerability<\/a>, the login attempt will be successful despite the expired password.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
The recommended mitigation for this vulnerability is to apply the vendor patch as soon as it becomes available. In the interim, organizations can use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to detect and prevent unauthorized access<\/a> attempts. Furthermore, organizations can also implement more frequent password changes<\/a> and monitor for unusual login activity as additional safeguards.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The recently identified vulnerability, CVE-2025-2291, poses a significant risk to systems utilizing the PgBouncer software. This vulnerability allows an attacker to log into a system with an already expired password. This is due to the auth_query functionality not considering the VALID UNTIL value from Postgres. As a result, systems that rely on PgBouncer for […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-34018","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t