retrieve database data with application server? [closed]

Question

retrieve database data with application server?

Answer 1

Possibly, yes. In many typical configurations, where servers have not had extensive security hardening, it would be possible.

Factors that might permit this:

• The application server would naturally require a network path to the database server, therefore any firewall would be configured to allow connections.

• The application server is likely, in a typical configuration, to be in possession of credentials for the database. These will often be stored inside the application's source code, or in a configuration file. (For example, the web.config file in ASP.NET applications.)

Therefore, the attacker could retrieve the credentials, and then use a database client on the application server to query the database.

Some factors that might guard against this:

• Strict file permissions on the file containing the database credentials. The user account you have compromised (that you can run commands as) may not have sufficient privileges.

• Similarly, the database credentials themselves might be encrypted, with strict file permissions on the encryption key (or an encryption key protected by a Hardware Security Module - HSM).

• Data within the database might be encrypted, with similar protection for the key as above.

• No credentials are stored, and authentication to the database is achieved through the application service's account credentials (e.g. via Kerberos to MSSQL). This would require a user with the correct database privileges to be compromised.

Most, if not all, of the above mechanisms could be defeated if the attacker had administrative control of the application server.