Eskalasi Hak Istimewa: Superuser Database AlloyDB Menulis ke Tabel Pengguna
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumen ini menjelaskan jenis temuan ancaman di Security Command Center. Temuan ancaman dibuat oleh
pendeteksi ancaman saat mendeteksi
potensi ancaman di resource cloud Anda. Untuk daftar lengkap temuan ancaman yang tersedia, lihat Indeks temuan ancaman.
Ringkasan
Akun superuser database AlloyDB untuk PostgreSQL (postgres)
menulis ke tabel pengguna. Pengguna super (peran dengan akses yang sangat luas) umumnya tidak boleh digunakan untuk menulis ke tabel pengguna. Akun pengguna dengan akses yang lebih terbatas
harus digunakan untuk aktivitas harian normal. Saat superuser menulis ke tabel pengguna, hal itu dapat menunjukkan bahwa penyerang telah meningkatkan hak istimewa atau telah membahayakan pengguna database default dan sedang mengubah data. Hal ini juga dapat menunjukkan praktik yang normal tetapi tidak aman.
Cara merespons
Untuk menanggapi temuan ini, lakukan hal berikut:
Langkah 1: Tinjau detail temuan
Buka temuan Privilege Escalation: AlloyDB Database Superuser Writes to User Tables, seperti yang diarahkan dalam Meninjau temuan.
Di tab Ringkasan pada panel detail temuan, tinjau informasi di bagian berikut:
Apa yang terdeteksi, terutama kolom berikut:
Nama tampilan database: nama database di instance AlloyDB untuk PostgreSQL yang terpengaruh.
Nama pengguna database: superuser.
Kueri database: kueri SQL yang dijalankan saat menulis ke tabel pengguna.
Resource yang terpengaruh, terutama kolom berikut:
Nama lengkap resource: nama resource instance AlloyDB untuk PostgreSQL yang terpengaruh.
Nama lengkap induk: nama resource instance AlloyDB untuk PostgreSQL.
Nama lengkap project: project Google Cloud yang berisi
instance AlloyDB untuk PostgreSQL.
Link terkait, terutama kolom berikut:
Cloud Logging URI: link ke entri Logging.
Metode MITRE ATT&CK: link ke dokumentasi MITRE ATT&CK.
Untuk melihat JSON lengkap temuan, klik tab JSON.
Langkah 2: Periksa log
Di konsol Google Cloud , buka Logs Explorer dengan mengklik
link di cloudLoggingQueryURI (dari Langkah 1).
Halaman Logs Explorer mencakup semua log yang terkait dengan instance AlloyDB for PostgreSQL yang relevan.
Periksa log pgaudit PostgreSQL, yang berisi kueri yang dijalankan oleh superuser, dengan menggunakan filter berikut:
Untuk menentukan apakah langkah-langkah perbaikan tambahan diperlukan, gabungkan hasil penyelidikan Anda dengan penelitian MITRE.
Langkah 4: Terapkan respons Anda
Rencana respons berikut mungkin sesuai untuk temuan ini, tetapi juga dapat memengaruhi operasi.
Evaluasi dengan cermat informasi yang Anda kumpulkan dalam penyelidikan untuk menentukan cara terbaik dalam menyelesaikan temuan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-05 UTC."],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nThe AlloyDB for PostgreSQL database superuser account (`postgres`)\nwrote to user tables. The superuser (a role with very broad access) generally\nshouldn't be used to write to user tables. A user account with more limited access\nshould be used for normal daily activity. When a superuser writes to a user\ntable, that could indicate that an attacker has escalated privileges or has\ncompromised the default database user and is modifying data. It could also\nindicate normal but unsafe practices.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open an `Privilege Escalation: AlloyDB Database Superuser Writes to User Tables` finding, as directed in [Reviewing findings](/security-command-center/docs/how-to-investigate-threats#reviewing_findings).\n2. On the **Summary** tab of the finding details panel, review the\n information in the following sections:\n\n - **What was detected** , especially the following fields:\n - **Database display name**: the name of the database in the AlloyDB for PostgreSQL instance that was affected.\n - **Database user name**: the superuser.\n - **Database query**: the SQL query executed while writing to user tables.\n - **Affected resource** , especially the following fields:\n - **Resource full name**: the resource name of the AlloyDB for PostgreSQL instance that was affected.\n - **Parent full name**: the resource name of the AlloyDB for PostgreSQL instance.\n - **Project full name**: the Google Cloud project that contains the AlloyDB for PostgreSQL instance.\n - **Related links** , especially the following fields:\n - **Cloud Logging URI**: link to Logging entries.\n - **MITRE ATT\\&CK method**: link to the MITRE ATT\\&CK documentation.\n3. To see the complete JSON for the finding, click the **JSON** tab.\n\nStep 2: Check logs\n\n1. In the Google Cloud console, go to **Logs Explorer** by clicking the link in `cloudLoggingQueryURI` (from [Step 1](#privesc_alloydb_database_superuser_writes_to_user_tables_findings)). The **Logs Explorer** page includes all logs related to the relevant AlloyDB for PostgreSQL instance.\n2. Check the logs for PostgreSQL pgaudit logs, which contain the queries executed by the superuser, by using the following filters:\n - `protoPayload.request.user=\"postgres\"`\n\nStep 3: Research attack and response methods\n\n1. Review the MITRE ATT\\&CK framework entry for this finding type: [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1078/001/).\n2. To determine if additional remediation steps are necessary, combine your investigation results with MITRE research.\n\nStep 4: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n- [Review the users allowed to connect to the database](/alloydb/docs/database-users/about#manage-users).\n- [Consider changing the password for the superuser](/alloydb/docs/database-users/about#change-password).\n- Consider [creating a new, limited access user](/alloydb/docs/database-users/about#create) for the different types of queries used on the instance.\n - [Grant the new user only the necessary permissions needed to execute their queries](/alloydb/docs/database-users/about#create).\n - Update the credentials for the clients that connect to the AlloyDB for PostgreSQL instance\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
