CME-920

Database Least-Privilege Access Control

Harden Application Unquantified evidence Preventive

Description

Enforce database-level access control by assigning each application service a dedicated database account with GRANT-limited permissions. App accounts receive only SELECT, INSERT, UPDATE, DELETE on specific tables — never CREATE, DROP, ALTER, GRANT, or DBA/superuser roles. Prevents SQL injection from escalating to schema modification, cross-database access, or OS command execution via xp_cmdshell/COPY/LOAD_FILE. Each microservice or application component should use a separate credential with the minimum privilege set required for its operations.

CVSS Vector Impacts

Metric	Transition	Rationale
Confidentiality (C)	H → L	SQL injection cannot exfiltrate data from other databases or tables outside the app account's GRANT scope; UNION-based extraction is limited to the account's SELECT privileges
Integrity (I)	H → L	Cannot modify schema, drop tables, or alter other services' data; DML limited to explicitly GRANTed tables

CWE Relationships

CWE-89 CWE-250 CWE-862 CWE-269

Verification

Verify application database accounts have no superuser, DDL, or GRANT privileges

$ psql -h localhost -U <app_user> -c "SELECT rolsuper, rolcreatedb, rolcreaterole FROM pg_roles WHERE rolname='<app_user>'"
# Expected: f|f|f

Platform: linux

$ psql -h localhost -U <app_user> -c "SELECT grantor, privilege_type FROM information_schema.role_table_grants WHERE grantee='<app_user>'" | grep -iE 'create|drop|alter|grant'

Platform: linux

$ Invoke-Sqlcmd -Query "SELECT IS_SRVROLEMEMBER('sysadmin', '<app_user>')"
# Expected: 0

Platform: windows

$ Invoke-Sqlcmd -Query "SELECT dp.permission_name FROM sys.database_permissions dp JOIN sys.database_principals pr ON dp.grantee_principal_id = pr.principal_id WHERE pr.name = '<app_user>' AND dp.permission_name IN ('ALTER','CREATE','CONTROL')"
# Expected: (0 rows affected)

Platform: windows

Platform: linux