Detections
Analytics

5.12 Ensure Proper Use Of 'ALLOW_NONEXISTENT_DEFINER'

Information

It's critical to limit users' ability to set an effective authorization ID that is used with executing a view or stored program. This grant provides a method to escalate privileges within MySQL views and procedures. A user with this privilege can specify a non-existing account as the DEFINER attribute for CREATE PROCEDURE, CREATE FUNCTION, CREATE TRIGGER, CREATE EVENT, ALTER EVENT, CREATE VIEW, and ALTER VIEW.

Later, a user with escalated privileges could be created, providing unintended access rights which can be improperly used.

This permission is often needed temporarily when performing database migration. Once a migration, is complete this permission is typically no longer necessary and should be removed.

Enabling a user to create a view, stored procedure or function and later create a user that improperly escalates privileges may provide unintended access rights which can be improperly used.

Solution

Perform the following steps to remediate this setting:

 - Enumerate the non-administrative users found in the result set of the audit procedure
 - For each user, issue the following SQL statement (replace <user> with the non-administrative user):
REVOKE ALLOW_NONEXISTENT_DEFINER ON *.* FROM '<user>';

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: PLANNING, SYSTEM AND SERVICES ACQUISITION

References: 800-53|PL-8, 800-53|SA-8, CSCv7|14.6

Plugin: MySQLDB

Control ID: c2492df4e25a361cc3444f1c5a4fb91f26a3bc500de31146040758185607b341