Ensure 'Control Server' permission is not granted

高级别 1人工审核mssql

说明

The Control Server permission is a highly privileged server-level permission in SQL Server database engine. Moreover, even though this permission is not as powerful as SYSADMIN role, it has almost most of the permissions of SYSADMIN role. Also, database logins granted control server permission can easily elevate to SYSADMIN role through different exploit techniques which is a serious security problem. This will greatly reduce attack surface, as accounts that get compromised by attackers with Control Server permission can escalate to SYSADMIN role. So, attackers can’t break into the database system with highly privileged accounts. Revoking control server permission will prevent privilege elevation attacks.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Execute this SQL query to list all SQL Server logins with Control Server permission: SELECT sys.server_permissions.type, sys.server_permissions.permission_name, sys.server_permissions.state, sys.server_permissions.state_desc, granteeserverprincipal.name AS grantee_principal_name, granteeserverprincipal.type_desc AS grantee_principal_type_desc, grantorserverprinicipal.name AS grantor_name, CASE WHEN sys.server_permissions.state = N'W' THEN N'GRANT' ELSE sys.server_permissions.state_desc END + N' ' + sys.server_permissions.permission_name COLLATE SQL_Latin1_General_CP1_CI_AS + N' TO ' + QUOTENAME(granteeserverprincipal.name) AS permissionstatement FROM sys.server_principals AS granteeserverprincipal INNER JOIN sys.server_permissions ON sys.server_permissions.grantee_principal_id = granteeserverprincipal.principal_id INNER JOIN sys.server_principals AS grantorserverprinicipal ON grantorserverprinicipal.principal_id = sys.server_permissions.grantor_principal_id WHERE sys.server_permissions.permission_name='CONTROL SERVER' AND granteeserverprincipal.name <> '##MS_PolicySigningCertificate##';

修复方式

修复方法: 操作指南或基础设施补丁

Remove any un-allowed SQL Server accounts which are granted Control Server using this query: use [master] GO REVOKE CONTROL SERVER FROM <login_name>

属性

操作系统: 任意
标签: access-controlmssqlsqlserver-2022
参考: CIS Microsoft SQL Server 2022 Benchmark v1.3.0 - 3.14 Ensure 'Control Server' permission is not granted