Ensure no admin role membership in MSDB database

中级别 1自动化mssql

说明

Based on Microsoft design an account with DB_OWNER can elevate permissions to SYSADMIN MSDBmust be configured with the TRUSTWORTHY flag ON to work properly. If the TRUSTWORTHY setting is set to ON, and if the owner of the database is a member of a group that has administrative credentials, such as the sysadmin group (for example the default sa login), the database owner can then be able to create and run unsafe assemblies that can compromise the instance of the SQL Server, as well as run code to elevate his privileges to SYSADMIN

检查方式

审计方法: SQL 查询

sql_query

sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; SELECT COUNT(*) FROM msdb.sys.database_role_members AS drm JOIN msdb.sys.database_principals AS r ON drm.role_principal_id = r.principal_id JOIN msdb.sys.database_principals AS m ON drm.member_principal_id = m.principal_id WHERE r.name IN ('db_owner','db_securityadmin','db_ddladmin','db_datawriter') AND m.name <> 'dbo';"

预期输出: 0

修复方式

修复方法: 操作指南或基础设施补丁

USE [msdb] GO ALTER ROLE [db_owner] DROP MEMBER <username>;

属性

操作系统: 任意
标签: iammssqlsqlserver-2022
参考: CIS Microsoft SQL Server 2022 Benchmark v1.3.0 - 3.13 Ensure no admin role membership in MSDB database

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target mssql