liveBook · Manning

Execute permission

As explained in 100 SQL Server Mistakes and How to Avoid Them

An execute permission grants the ability to invoke a specified SQL Server routine or procedure.

Execute permission grants the ability to invoke a specified SQL Server routine or procedure. For xp_cmdshell, it is one possible route to execution, alongside sysadmin membership and CONTROL SERVER. section 14.4 section 14.4

Treat direct execute grants as security-sensitive because they can be less visible than role membership.

  • Check beyond sysadmin membership: direct CONTROL SERVER, EXECUTE, or IMPERSONATE permissions may create opaque access paths. section 14.4
  • Do not assume disabling xp_cmdshell removes the risk; an account with sufficient authority can enable it again. section 14.4

The restricted-OS DBA

A DBA barred by company policy from operating-system access may use xp_cmdshell as a back door to the operating system, turning an execute grant into a policy and lateral-movement concern. section 14.4

Lateral movement

Use the lateral-movement figure to connect routine execution permissions with broader operating-system security exposure. section 14.4

How 100 SQL Server Mistakes and How to Avoid Them covers it

How deep it goes
Explains authorization alternatives and their opacity, but does not provide grant syntax or a complete permission-auditing procedure.
Examples
Uses xp_cmdshell access by a DBA without operating-system permissions as the concrete security scenario.
What you can do after
Evaluate whether routine execution permissions create opaque access paths or violate operating-system security policy.
How it connects
Connects execute permission with xp_cmdshell, sysadmin, CONTROL SERVER, IMPERSONATE, and lateral movement.
Cover of 100 SQL Server Mistakes and How to Avoid Them
liveBookmanning.com
Read 100 SQL Server Mistakes and How to Avoid Them on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of 100 SQL Server Mistakes and How to Avoid Them. The section links point to the parts of the book it draws on.