MySQL allows loading local data Affecting Cloud SQL service in Google

Severity Framework Snyk CCSS

Rule category Data / Access

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Frameworks

CIS-Google GDPR HIPAA ISO-27001 SOC-2

Snyk ID SNYK-CC-00361
credit Snyk Research Team

Report a new misconfiguration Found a mistake?

Description

The MySQL database instance 'local_infile' flag controls server-side LOCAL capabilities for LOAD DATA statements. If permitted, clients can perform local data loading, which can be a security risk.

How to fix?

Set settings.database_flags.name attribute to "local_infile", and settings.database_flags.value attribute to "off".

Example Configuration

resource "google_sql_database_instance" "allowed" {
  name             = "master-instance"
  database_version = "MYSQL_5_6"
  region           = "us-central1"

  settings {
    tier = "db-f1-micro"
    database_flags {
      name  = "local_infile"
      value = "off"
    }
  }
}

Terraform

Resource: google_sql_database_instance