Privilege Escalation in Cockroachdb

Privilege escalation in CockroachDB occurs when a user or process gains access to data or operations beyond what their assigned role permits. This can happen through improper configuration of role grants, misuse of SQL privileges, or unchecked user input that influences authorization decisions. A typical attack pattern involves a client submitting a crafted SQL statement that bypasses row‑level security, allowing the attacker to read or modify rows owned by other users. For example, CockroachDB supports row‑level access control via CREATE ROLE and GRANT statements, but if a developer inadvertently grants ALL PRIVILEGES on a table to a public role, any unauthenticated request can execute queries that enumerate or alter sensitive data.

One documented issue is CVE-2022-23943, where CockroachDB versions prior to 22.2.0 allowed a user with the CREATE USER privilege to create additional accounts with elevated rights, effectively bypassing intended permission boundaries. The vulnerability stems from insufficient validation of the ADMIN flag during role creation, enabling an attacker to elevate their privileges without proper audit. Such scenarios map to OWASP API Top 10 A01:2023 – Broken Access Control, where the application fails to enforce the principle of least privilege.

Specific code paths where escalation can manifest include the SQL parser’s handling of SET ROLE and the internal permission checker that evaluates GRANTED BY clauses. If a developer writes code that dynamically constructs a query based on user‑supplied input without sanitizing the role name, an attacker can inject a role that grants additional permissions. For instance, using the Go driver, an unsafe query might look like:

stmt := `SET ROLE ` + userSuppliedRole + `; SELECT * FROM customers; DROP TABLE accounts;`
_, err := db.Exec(stmt)
if err != nil {
    log.Fatal(err)
}

If userSuppliedRole contains admin or another privileged role, the subsequent SELECT may execute with elevated rights, potentially exposing data that should be restricted.

middleBrick can identify privilege escalation exposure by scanning the unauthenticated API surface of a CockroachDB instance. The scanner issues a series of SQL‑like payloads that probe for overly permissive roles and unchecked SET ROLE usage. When a request returns a 200 status with a response body containing unrestricted query results or error messages that reveal role names, middleBrick flags the endpoint as high risk. The scan runs in 5‑15 seconds and reports a risk score along with a prioritized finding that includes a description of the vulnerable code path and a reference to CVE‑2022‑23943 for context.

In a typical CI/CD pipeline, a developer can invoke the CLI:

middlebrick scan https://api.example.com/v1/queries --format json

The JSON output includes an array of findings, each with a category field set to "Privilege Escalation", a severity value, and a remediationGuidance string that points to best‑practice configuration steps.

Because the scanner performs black‑box checks, it does not require credentials or internal network access, making it suitable for early detection before code is merged or deployed.

To remediate identified privilege escalation risks, developers should adopt strict role‑based access control (RBAC) patterns native to CockroachDB. Only grant the minimum privileges required for a given function, and avoid assigning ALL PRIVILEGES or ADMIN rights to non‑administrative roles. Use explicit GRANT SELECT, INSERT, UPDATE ON TABLE customers TO readonly_role; statements rather than broad grants.

When dynamic role switching is necessary, validate the role name against a whitelist of approved identifiers before embedding it in a query. A safer implementation in Python using the CockroachDB driver might look like:

allowed_roles = {"app_user", "reporting_user"}
role = user_input_role
if role not in allowed_roles:
    raise ValueError("Invalid role")
stmt = f"SET ROLE {role}; SELECT * FROM customers;"
cur.execute(stmt)

Additionally, enable row‑level security by defining policies that restrict access to rows based on ownership or tenant identifiers. For example:

CREATE POLICY tenant_isolation ON customers
FOR ALL TO PUBLIC
USING (tenant_id = current_setting('app.current_tenant'));

Finally, enforce least‑privilege principles in the application layer by rejecting any request that attempts to modify system tables or execute administrative commands unless the caller is explicitly authenticated as an admin. Regularly audit role assignments with SQL queries such as:

SELECT * FROM crdb_internal.role_table_grants WHERE granted_privilege = 'ALL';

These steps reduce the attack surface and align the deployment with OWASP API Top 10 recommendations for proper access control.