Detections
Analytics

4.4 Harden Usage for 'local_infile' on MySQL Clients

Information

The local_infile parameter dictates whether files located on the MySQL client's computer can be loaded or selected via LOAD DATA INFILE or SELECT local_file.

Disabling local_infile reduces an attacker's ability to read sensitive files off the affected server via a SQL injection vulnerability.

Solution

In the case where using local_infile is needed, the following changes further harden security:

On the client side, secure by:

Limiting the location from where data can be read using --load-data-local-dir.

mysql --local-infile=0 --load-data-local-dir=/my/local/data

Adding TLS connection to assure server identity by requiring verification.

mysql --local-infile=0 --load-data-local-dir=/my/local/data --ssl-mode=VERIFY_IDENTITY

If local_infile is not in use or if clients are not upgraded, add the following line to the [mysqld] section of the MySQL configuration file and restart the MySQL service:

local-infile=0

Impact:

Disabling local_infile will impact the functionality of solutions that rely on it.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|4.7

Plugin: MySQLDB

Control ID: 953d28cd7ad1e7e549f984a5272db0ab4317199807f9d83e240f9dd6dc61a4b0