V-286188

Discussion

Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide or install by default functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. MariaDB may spawn additional external processes to execute procedures that are defined in MariaDB but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than MariaDB and provide unauthorized access to the host system.

Check Content

Log in to the MariaDB Enterprise Server as a database administrator.

Verify whether the "local_infile" option is enabled:

SHOW GLOBAL VARIABLES LIKE 'local_infile';

If "local_infile" is enabled (ON), review all database accounts and their assigned privileges to ensure only authorized users have the ability to perform file operations.

List all database accounts:

SELECT USER, HOST
FROM mysql.global_priv;

Execute the following for each account returned:

SHOW GRANTS FOR 'user'@'host';

Replace user and host with the values returned from the previous query.

Review each grant for the presence of:

FILE
GRANT OPTION

Review the grants assigned to each role using:

SHOW GRANTS FOR role_name;

Review the output to determine whether the FILE privilege or the ability to grant that privilege has been assigned only to authorized users or roles.

If local_infile is enabled and any unauthorized user or role possesses the FILE privilege or GRANT OPTION, this is a finding.