STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

Execution of software modules (to include stored procedures, functions, and triggers) with elevated privileges must be restricted to necessary cases only.

DISA Rule

SV-235180r638812_rule

Vulnerability Number

V-235180

Group Title

SRG-APP-000342-DB-000302

Rule Version

MYS8-00-010600

Severity

CAT II

CCI(s)

• CCI-002233 - The information system prevents organization-defined software from executing at higher privilege levels than users executing the software.

Weight

10

Fix Recommendation

Remove any procedures that are not authorized.

Drop the procedure or function using
DROP PROCEDURE <proc_name>;
DROP FUNCTION <function_name>;

Check Contents

Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes.

SHOW PROCEDURE STATUS where security_type <> 'INVOKER';
SHOW FUNCTION STATUS where security_type <> 'INVOKER';

If DEFINER accounts are returned that are not documented and authorized, this is a finding.

If elevation of MySQL privileges using DEFINER is documented, but not implemented as described in the documentation, this is a finding.

If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.

Vulnerability Number

V-235180

Documentable

False

Rule Version

MYS8-00-010600

Severity Override Guidance

Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes.

SHOW PROCEDURE STATUS where security_type <> 'INVOKER';
SHOW FUNCTION STATUS where security_type <> 'INVOKER';

If DEFINER accounts are returned that are not documented and authorized, this is a finding.

If elevation of MySQL privileges using DEFINER is documented, but not implemented as described in the documentation, this is a finding.

If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.

Check Content Reference

M

Target Key

5277

Comments