[DERBY-6616] User procedures can call system procedures, circumventing SQL authorization.

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.11.1.1
• Component/s: SQL
• Urgency: Normal
• Issue & fix info: Patch Available, Repro attached
• Bug behavior facts: Security
• Assignee: Richard N. Hillegas
• Reporter: Richard N. Hillegas
• Created: 17/Jun/14 13:32
• Updated: 09/Sep/16 09:51
• Resolved: 10/Jul/14 16:54

Description

System procedures are implemented as public static methods in org.apache.derby.catalog.SystemProcedures. These methods can be called by code in user-written procedures. This allows a user-written procedure to circumvent the SQL authorization checks which are supposed to limit some procedures to being called only by the DBO. I will attach a repro.

Issue Links

• is related to: DERBY-6646 Applications can bypass the authorization checks on SYSCS_EXPORT_TABLE and SYSCS_IMPORT_TABLE by calling Export.exportTable() and Import.importTable() directly
• is related to: DERBY-6648 Application code should not be able to call ContextService.getContextOrNull()