Detections
Analytics

5.11 Ensure Proper Use Of 'SET_ANY_DEFINER'

Information

It's critical to limit users' ability to set an effective authorization ID that is used when executing a view or stored program. This grant provides a method to escalate privileges within MySQL views and procedures. A user with this privilege can specify any account as the DEFINER attribute for CREATE PROCEDURE, CREATE FUNCTION, CREATE TRIGGER, CREATE EVENT, ALTER EVENT, CREATE VIEW, and ALTER VIEW . Without this privilege, only the effective authorization ID can be specified.

Enabling a user to create a view, stored procedure or function that improperly escalates privileges may provide unintended access rights that can be improperly used.

Note: In previous versions of MySQL, users required a grant to SET_USER_ID privilege to create procedures with DEFINER set.

Solution

Perform the following steps to remediate this setting:

 - Enumerate the non-administrative users found in the result set of the audit procedure
 - For each user, issue the following SQL statement (replace <user> with the non-administrative user):
REVOKE SET_ANY_DEFINER ON *.* FROM '<user>';

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: PLANNING, SYSTEM AND SERVICES ACQUISITION

References: 800-53|PL-8, 800-53|SA-8, CSCv7|14.6

Plugin: MySQLDB

Control ID: 0fec0a2c8fc4b96ce9c38ebc0307c164fd775529a138b459946d944470eba050