What can be done with MySQL password

Question

Let's say there's a simple website hosted on the web, based on Flask + MySQL. The website's functionality is secure and does not allow arbitrary queries to be run against the database.

However, let's say someone gains unauthorized access to the username and password of the MySQL database (i.e. those used in the database URI).

Will this information actually allow them to do anything?

Answer 1

The leaked database credentials could potentially give an attacker the ability to interact with the database with the same privileges as the web application (assuming you created a low-privilege account for the web application to access the database with; you're not using "root", right?). This means they could possibly dump all data, or manipulate and add entries at will.

That said, the attacker would need a way to actually connect to the database, for which there are several conditions that must all be met:

1. The MySQL service is listening on a public-facing address (default is localhost only)
2. The host's firewall (if configured) must allow inbound access to the MySQL port
3. The target MySQL user account must be set up to allow the source IP address the attacker will use, or all addresses with a wildcard (usually, only localhost is allowed, unless remote hosts need the database as well)
4. Once connected, the user account must have permissions to read, write, or modify, depending on what the attacker is trying to do

If all 4 conditions are met, it is likely possible for an attacker to do something, depending on the privileges of the account. However, some of those conditions are unlikely, and often require the administrator to go out of their way to make these changes, therefore compromise in this way is unlikely.

Moreover, if an attacker manages to gain shell or compromise another service on the same host, they may be able to bypass 1-3 above and connect to the database on localhost.

Answer 2

The website's functionality is secure and does not allow arbitrary queries to be run against the database.

However, let's say someone gains unauthorized access to the username and password of the MySQL database (i.e. those used in the database URI).

Not sure if this is what you're implying, but it's not enough that the website's functionality has to be secure - the whole server running the MySQL database has to be secure as well. Your website can be as watertight as it likes, but, to take the extreme case, if the backend MySQL database is running on a publically accessible IP, and listening to requests globally, that username and password will then allow you to connect to it and run all the arbitrary queries you like.

Bypassing the above, other aspects such as password reusability, and assuming everything is "completely" secured and locked down, then yes, those credentials aren't of any specific use. Like pretty much every strategy in this domain, keeping them secret is to add a layer of security should vulnerabilities ever be found that would make those credentials useful.

In practice, locking those credentials down should be pretty easy. So if an attacker has got their hands on them in the first place, the implication is that your setup is definitely not secure, and there's likely a whole host of other vulnerabilities yet to be unearthed.