{"id":107800,"date":"2025-11-05T11:47:02","date_gmt":"2025-11-05T11:47:02","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=107800"},"modified":"2025-12-11T13:55:15","modified_gmt":"2025-12-11T13:55:15","slug":"sql-injection-sql-server%e2%80%90dbaas","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/cloud\/security-and-compliance\/sql-injection-sql-server%e2%80%90dbaas\/","title":{"rendered":"SQL Server DBaaS Vulnerability: Decrypting System Code & Exfiltrating User Data"},"content":{"rendered":"\n

Security in cloud environments is both challenging and fascinating, particularly for Database-as-a-Service (DBaaS)<\/a> offerings like Amazon RDS<\/a>, GCP CloudSQL<\/a> and Alibaba ApsaraDB RDS<\/a>. The cloud vendor acts as the system administrator, managing the operating system, patching, and backups, while the user manages their data and databases.<\/p>\n\n\n\n

To uphold this managed experience and protect the platform’s integrity, each vendor implements strict access controls, effectively removing the customer’s ability to access high-privilege system roles like sysadmin or internal databases. The core idea is simple: limit what users can do and see<\/strong> to protect the underlying infrastructure and other tenants.<\/p>\n\n\n\n

They say:<\/p>\n\n\n\n

Google <\/a>CloudSQL<\/a> – \u201cThe sysadmin role is not supported<\/em><\/strong>. Therefore, you cannot run system stored procedures that require the sysadmin role.\u201d<\/p>\n\n\n\n

Amazon RDS<\/a> – \u201cTo deliver a managed service experience, Amazon RDS does not provide shell access to DB instances, and it restricts access<\/em><\/strong> to certain system procedures and tables that require advanced privileges<\/em><\/strong>.\u201d<\/p>\n\n\n\n

Alibaba ApsaraDB<\/a> RDS<\/a> – \u201cSQL Server as a Platform as a Service (PaaS) service does not provide instance-level access<\/em><\/strong> permissions.\u201d<\/p>\n\n\n\n

This article explores a serious flaw in this security model – a SQL Injection<\/a> vulnerability in sys.sp_help_spatial_geography_histogram<\/code> that allowed a standard user on managed SQL Server instances (AWS, GCP, Alibaba, Azure) to completely bypass these restrictions, gain access to privileged user data<\/strong>, and decrypt the source code<\/strong> of internal management stored procedures.<\/p>\n\n\n\n

It was fixed in SQL Server 2022 CU20 (KB5063814), but this article explains how the exploit worked and the process of eliminating it.<\/p>\n\n\n\n

Encrypted Modules for Each Vendor: What Are They?<\/h2>\n\n\n\n

Each vendor instance includes an internal database (rdsadmin<\/code><\/strong> on AWS, gcloud_cloudsqladmin<\/code><\/strong> on GCP and rdscore<\/code> <\/strong>on Alibaba)<\/strong>. This is a system database created and managed by the vendor to host internal stored procedures and configuration tables necessary for the managed environment (e.g., handling backups, configuration changes, and maintenance).<\/p>\n\n\n\n

There are some specific modules (stored procedures<\/a>, functions<\/a> or triggers<\/a>) created to help automate SQL Server<\/a> tasks. Those modules can exist on master, msdb or in an internal database.<\/p>\n\n\n\n

Following is the current list (as per today 2025-10-29) of encrypted modules for each vendor:<\/p>\n\n\n\n

AWS<\/h5>\n\n\n\n
DROP TABLE IF EXISTS #tmp1\nCREATE TABLE #tmp1 ([DbName] sysname, [ObjID] INT, ObjName sysname, [IsEncrypted] BIT)\n\nINSERT INTO #tmp1\nEXEC rdsadmin.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, OBJECT_NAME([object_id]) AS ObjName, OBJECTPROPERTY([object_id], ''IsEncrypted'') AS IsEncrypted\n       FROM sys.all_sql_modules\n       WHERE OBJECTPROPERTY([object_id], ''IsEncrypted'') = 1'\nINSERT INTO #tmp1\nEXEC msdb.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, OBJECT_NAME([object_id]) AS ObjName, OBJECTPROPERTY([object_id], ''IsEncrypted'') AS IsEncrypted\n       FROM sys.all_sql_modules\n       WHERE OBJECTPROPERTY([object_id], ''IsEncrypted'') = 1'\nINSERT INTO #tmp1\nEXEC master.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, OBJECT_NAME([object_id]) AS ObjName, OBJECTPROPERTY([object_id], ''IsEncrypted'') AS IsEncrypted\n       FROM sys.all_sql_modules\n       WHERE OBJECTPROPERTY([object_id], ''IsEncrypted'') = 1'\nINSERT INTO #tmp1\nEXEC master.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, name AS ObjName, 1\n       FROM sys.server_triggers'\n\nSELECT * FROM #tmp1\nGO<\/pre><\/div>\n\n\n\n
Result:<\/strong><\/p>\n\n\n\n
DbName              ObjID       ObjName                                 IsEncrypted\n------------------- --------------------------------------------------- -----------\nrdsadmin            1509580416  rds_max_customer_db_count               1\nrdsadmin            1733581214  rds_is_db_owner                         1\nrdsadmin            1749581271  rds_read_error_log                      1\nrdsadmin            1765581328  rds_set_configuration                   1\nrdsadmin            1781581385  rds_show_configuration                  1\nrdsadmin            1797581442  rds_set_database_online                 1\nrdsadmin            1813581499  rds_modify_db_name                      1\nmsdb                530816953   rds_sysmail_control                     1\nmsdb                546817010   rds_fn_sysmail_allitems                 1\nmsdb                562817067   rds_fn_sysmail_event_log                1\nmsdb                578817124   rds_fn_sysmail_mailattachments          1\nmsdb                594817181   rds_sysmail_delete_mailitems_sp         1\nmsdb                610817238   rds_fn_server_object_last_sync_time     1\nmsdb                626817295   rds_fn_get_system_database_sync_objects 1\nmsdb                642817352   rds_set_system_database_sync_objects    1\nmsdb                658817409   rds_manage_view_db_permission           1\nmsdb                674817466   rds_xpc_disable                         1\nmsdb                690817523   rds_xpc_enable                          1\nmsdb                706817580   rds_backup_database                     1\nmsdb                722817637   rds_backup_tde_certificate              1\nmsdb                738817694   rds_cancel_task                         1\nmsdb                754817751   rds_dms_tlog_download                   1\nmsdb                770817808   rds_dms_tlog_list_current_lsn           1\nmsdb                786817865   rds_dms_tlog_read                       1\nmsdb                802817922   rds_drop_tde_certificate                1\nmsdb                818817979   rds_finish_restore                      1\nmsdb                834818036   rds_fn_list_tlog_backup_metadata        1\nmsdb                850818093   rds_fn_list_user_tde_certificates       1\nmsdb                866818150   rds_restore_database                    1\nmsdb                882818207   rds_restore_log                         1\nmsdb                898818264   rds_restore_tde_certificate             1\nmsdb                914818321   rds_task_status                         1\nmsdb                930818378   rds_tlog_copy_setup                     1\nmsdb                946818435   rds_tlog_backup_copy_to_S3              1\nmsdb                962818492   rds_fn_task_status                      1\nmsdb                978818549   rds_shrink_tempdbfile                   1\nmsdb                994818606   rds_drop_database                       1\nmsdb                1010818663  rds_cdc_disable_db                      1\nmsdb                1026818720  rds_cdc_enable_db                       1\nmsdb                1042818777  rds_fn_get_audit_file                   1\nmsdb                1058818834  rds_download_from_s3                    1\nmsdb                1074818891  rds_delete_from_filesystem              1\nmsdb                1090818948  rds_gather_file_details                 1\nmsdb                1106819005  rds_fn_list_file_details                1\nmsdb                1122819062  rds_sqlagent_proxy                      1\nmsdb                1138819119  rds_msbi_task                           1\nmsdb                1154819176  rds_upload_to_s3                        1\nmsdb                1170819233  rds_msdtc_transaction_tracing           1\nmsdb                1186819290  rds_drop_ssrs_databases                 1\nmsdb                1202819347  rds_drop_ssis_database                  1\nmsdb                1218819404  rds_failover_time                       1\nmsdb                1250819518  rds_changedbowner_to_rdsa               1\nmsdb                1266819575  rds_fn_internal_get_audit_file          1\nmsdb                1490820373  rds_agent_jobs_trigger                  1\nmaster              919674324   rds_is_db_read_replica                  1\nmaster              935674381   rds_is_db_writable                      1\nmaster              1287675635  rds_hexadecimal                         1\nmaster              1303675692  rds_help_revlogin                       1\nmaster              1367675920  rds_startup_tasks                       1\nmaster              1559676604  rds_alter_database_trigger              1\nmaster              1575676661  rds_create_database_trigger             1\nmaster              1591676718  rds_deny_backups_trigger                1\nmaster              1607676775  rds_drop_database_trigger               1\nmaster              1623676832  rds_drop_login_trigger                  1\nmaster              1655676946  rds_create_login_trigger                1\nmaster              1671677003  rds_audit_trigger                       1\nmaster              1687677060  rds_das_trigger                         1\nmaster              1703677117  rds_credential_trigger                  1\nmaster              1719677174  rds_extended_events_trigger             1\n\n(69 rows affected)<\/pre><\/div>\n\n\n\n
GCP<\/h5>\n\n\n\n
DROP TABLE IF EXISTS #tmp1\nCREATE TABLE #tmp1 ([DbName] sysname, [ObjID] INT, ObjName sysname, [IsEncrypted] BIT)\n\nINSERT INTO #tmp1\nEXEC msdb.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, OBJECT_NAME([object_id]) AS ObjName, OBJECTPROPERTY([object_id], ''IsEncrypted'') AS IsEncrypted\n       FROM sys.all_sql_modules\n       WHERE OBJECTPROPERTY([object_id], ''IsEncrypted'') = 1'\nINSERT INTO #tmp1\nEXEC master.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, OBJECT_NAME([object_id]) AS ObjName, OBJECTPROPERTY([object_id], ''IsEncrypted'') AS IsEncrypted\n       FROM sys.all_sql_modules\n       WHERE OBJECTPROPERTY([object_id], ''IsEncrypted'') = 1'\nINSERT INTO #tmp1\nEXEC master.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, name AS ObjName, 1\n       FROM sys.server_triggers'\n\nSELECT * FROM #tmp1\nGO<\/pre><\/div>\n\n\n\n
Result:<\/strong><\/p>\n\n\n\n
DbName   ObjID       ObjName                                         IsEncrypted\n-------- ----------- ----------------------------------------------- -----------\nmsdb     1270295585  gcloudsql_cdc_disable_db                        1\nmsdb     1286295642  gcloudsql_cdc_enable_db                         1\nmsdb     1302295699  gcloudsql_tempdb_shrinkfile                     1\nmsdb     1318295756  fn_gcloudsql_CleanSqlCommandText                1\nmsdb     1334295813  gcloudsql_disable_ddl_event_tr                  1\nmsdb     1350295870  gcloudsql_transrepl_addlogreader_agent          1\nmsdb     1366295927  gcloudsql_transrepl_addmonitoraccess            1\nmsdb     1382295984  gcloudsql_transrepl_addpublication              1\nmsdb     1398296041  gcloudsql_transrepl_addpublication_snapshot     1\nmsdb     1414296098  gcloudsql_transrepl_addpushsubscription_agent   1\nmsdb     1430296155  gcloudsql_transrepl_droppublication             1\nmsdb     1446296212  gcloudsql_transrepl_dropsubscriber              1\nmsdb     1462296269  gcloudsql_transrepl_remove_distribution         1\nmsdb     1478296326  gcloudsql_transrepl_replicationdboption         1\nmsdb     1494296383  gcloudsql_transrepl_setup_distribution          1\nmsdb     1510296440  gcloudsql_transrepl_changedistributor_property  1\nmsdb     1718297181  gcloudsql_drop_tde_user_certificate             1\nmsdb     1734297238  gcloudsql_rotate_tde_certificate                1\nmaster   535672956   TRG_ProtectDropCustRootLogin                    1\nmaster   551673013   gcloudsql_protectRoleMembership                 1\nmaster   567673070   gcloudsql_protectRoleAlteration                 1\nmaster   583673127   TRG_EnforceXEventSessionParams3                 1\nmaster   599673184   TRG_CheckInternalXEventSessionManipulation      1\nmaster   615673241   TRG_ProtectDropDatabaseRootLogin                1\nmaster   631673298   gcloudsql_RoleManagement                        1\nmaster   647673355   TRG_BlockDatabaseEncryptionKeyCreation_v2       1\nmaster   1271675578  TRG_EnforceXEventSessionParams2                 1\nmaster   1287675635  TRG_ProtectRootLogin_CloudDbSqlRoot_2           1\nmaster   1303675692  TRG_ProtectRootLogin_CloudDbSqlAgent_2          1\n\n(29 rows affected)<\/pre><\/div>\n\n\n\n
Alibaba<\/h5>\n\n\n\n
DROP TABLE IF EXISTS #tmp1\nCREATE TABLE #tmp1 ([DbName] sysname, [ObjID] INT, ObjName sysname, [IsEncrypted] BIT)\n\nINSERT INTO #tmp1\nEXEC master.sys.sp_executesql \n     N'SELECT db_name() AS DbName, [object_id] AS ObjId, OBJECT_NAME([object_id]) AS ObjName, OBJECTPROPERTY([object_id], ''IsEncrypted'') AS IsEncrypted\n       FROM sys.all_sql_modules\n       WHERE OBJECTPROPERTY([object_id], ''IsEncrypted'') = 1'\n\nSELECT * FROM #tmp1\nGO<\/pre><\/div>\n\n\n\n
Result:<\/strong><\/p>\n\n\n\n
DbName   ObjID       ObjName                         IsEncrypted\n-------- ----------- ------------------------------- -----------\nmaster   1159675179  sp_rds_cdc_disable_db           1\nmaster   1175675236  sp_rds_cdc_enable_db            1\nmaster   1191675293  sp_rds_change_tracking          1\nmaster   1223675407  sp_rds_set_all_db_privileges    1\nmaster   1239675464  sp_rds_set_db_online            1\nmaster   1255675521  sp_rds_deny_view_any_database   1\nmaster   1271675578  sp_rds_free_proc_cache          1\nmaster   1287675635  sp_rds_read_error_logs          1\nmaster   1399676034  sp_rds_copy_database            1\nmaster   1415676091  sp_rds_update_db_stats          1\nmaster   1559676604  sp_disable_cdc_db_ddl_event     1\nmaster   1575676661  sp_enable_cdc_db_ddl_event      1\nmaster   1591676718  sp_rds_modify_db_name           1\nmaster   1607676775  sp_rds_cycle_errorlog           1\nmaster   1623676832  sp_rds_configure                1\nmaster   1655676946  sp_rds_dbcc_trace               1\nmaster   1879677744  fn_rds_get_wait_category        1\n\n(17 rows affected)<\/pre><\/div>\n\n\n\n
These modules are encrypted for several crucial reasons:<\/p>\n\n\n
\n