Escalating Privileges In the Database Can Wreak Havoc

By Alex RothackerPrivilege escalation attacks consist of exploiting a bug or design flaw in a software application to gain access to resources which normally are protected from an application or user. The result is that the application allows actions with privileges beyond an acceptable level for the specific user.  

Privilege escalation attacks consist of exploiting a bug or design flaw in a software application to gain access to resources which normally are protected from an application or user. The result is that the application allows actions with privileges beyond an acceptable level for the specific user.  There are three main forms of privilege escalation, the most serious being vertical privilege escalation. An example would be a regular read-only user acquiring admin rights. Next there is horizontal privilege escalation where for example a user with rights in the accounting database might acquire access to the human resources database. Finally, there’s privilege de-escalation, that when executed correctly, one would lose some of the rights required to perform a job.

A major issue within an organization directly related to privilege escalation attacks is user access to a database. We often talk about abusive or malicious insiders in relation to these attacks. A primary problem is the fact that most organizations do not know, and cannot document, who has access, or how much access they have to sensitive data on an enterprise database system.

A few examples follow…

SYS.DBMS_CDC_IMPDP vulnerability
SYS.DBMS_CDC_IMPDP is a package that in older un-patched versions of Oracle contains procedures that allow privilege escalation through SQL Injection. By default, this package is granted to PUBLIC and the package is owned by the SYS schema in Oracle Database v10g.

[block:block=47]

The exploitation of this instance of SQL Injection can result in commands executed under the elevated privileges of the SYS user, because the package owners (those who hold the license) usually possess elevated privileges resulting in potential security problems in the Oracle Database v10g.

SYS.DBMS_DBUPGRADE vulnerability
Another database exploit through privilege escalation is SYS.DBMS_DBUPGRADE, which contains an instance of SQL injection that ultimately allows any user with ‘execute’ privileges on this package to execute commands under the elevated privileges of the SYS user.

Know Your Rights!

A best practice for granting access and permissions to database users within an organization is the principle of least privilege (PLP). It requires that users have the least amount of privileges required to perform their specific duties.  Users should not be granted access to sensitive information that is not required to perform their jobs, or in general have privileges to execute any non-essential actions.

Collecting and documenting a comprehensive list of all the rights a user has been granted (or has not been granted) can be a daunting task. Privileges should never be assigned directly to users, but only to roles/groups of which the users are members. Always make sure that users are not assigned to groups with unnecessary privileges.

Implementing a user rights management solution will help an organization to discover, document and address the web of privileges and permissions that exist in the database environment. In addition, it will help identify abusive users and allow organizations to meet separation of duties requirements of major compliance regulations.

Alex Rothacker is the manager of the SHATTER research team at Application Security.

Suggested articles

Adobe Accelerates Patch Schedule for Critical Flash Bug

Adobe has moved up the release date for the patch for the critical bug in Adobe Flash Player revealed last week, and now plans to have a fix ready on Thursday. The company still plans to patch Reader two weeks from now.

EU Agency Says Stuxnet Portends Future Sophisticated Attacks

The European agency responsible for protecting the critical infrastructure of EU countries is warning its member states that the Stuxnet attack represents a major change in the malware landscape and that they should be prepared for further attacks with the same level of sophistication and professionalism.

Google Unveils Gmail Security Checklist

In the face of continued attacks targeting its hugely popular Gmail service, Google has put together a checklist to help Gmail users better secure their accounts by looking at the settings in their inboxes, their browsers and their PCs. The security guide doesn’t automate any of these tasks for users, but instead gives them a guide comprising 18 steps to help lock down their Gmail inboxes.

Discussion

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.