STIGQter: STIG Summary: Microsoft Azure SQL Managed Instance Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 23 Sep 2025:

Azure SQL Managed Instance and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.

DISA Rule

SV-276230r1150043_rule

Vulnerability Number

V-276230

Group Title

SRG-APP-000251-DB-000392

Rule Version

MSQL-00-002300

Severity

CAT II

CCI(s)

• CCI-001310 - Checks the validity of organization-defined information inputs to the system.

Weight

10

Fix Recommendation

Where dynamic code execution is used, modify the code to implement protections against code injection.

When the objective could practically be satisfied by static execution with strongly typed parameters, modify the code to do so.

Check Contents

Review the system documentation to obtain a listing of stored procedures and functions that utilize dynamic code execution. Execute the following query:

DECLARE @tblDynamicQuery TABLE (ID INT identity(1,1), ProcToExecuteDynSQL VARCHAR(500))
INSERT INTO @tblDynamicQuery(ProcToExecuteDynSQL) values('EXEC[ (]@')
INSERT INTO @tblDynamicQuery(ProcToExecuteDynSQL) values('EXECUTE[ (]@')
INSERT INTO @tblDynamicQuery(ProcToExecuteDynSQL) values('SP_EXECUTESQL[ (]@')

SELECT
[DatbaseName] = DB_Name()
,[ObjectName] = SCHEMA_NAME([schema_id]) + '.' + (name)
,[ObjectType] = type_desc
FROM sys.objects o
WHERE o.is_ms_shipped = 0 and
o.object_id IN (
SELECT m.object_id
FROM sys.sql_modules m
JOIN @tblDynamicQuery dsql ON REPLACE(REPLACE(REPLACE(m.definition,CHAR(32),'()'),')(',''),'()',CHAR(32)) like '%' + dsql.ProcToExecuteDynSQL + '%')

If any procedures or functions are returned that are not documented, this is a finding.

Vulnerability Number

V-276230

Documentable

False

Rule Version

MSQL-00-002300

Severity Override Guidance

Review the system documentation to obtain a listing of stored procedures and functions that utilize dynamic code execution. Execute the following query:

DECLARE @tblDynamicQuery TABLE (ID INT identity(1,1), ProcToExecuteDynSQL VARCHAR(500))
INSERT INTO @tblDynamicQuery(ProcToExecuteDynSQL) values('EXEC[ (]@')
INSERT INTO @tblDynamicQuery(ProcToExecuteDynSQL) values('EXECUTE[ (]@')
INSERT INTO @tblDynamicQuery(ProcToExecuteDynSQL) values('SP_EXECUTESQL[ (]@')

SELECT
[DatbaseName] = DB_Name()
,[ObjectName] = SCHEMA_NAME([schema_id]) + '.' + (name)
,[ObjectType] = type_desc
FROM sys.objects o
WHERE o.is_ms_shipped = 0 and
o.object_id IN (
SELECT m.object_id
FROM sys.sql_modules m
JOIN @tblDynamicQuery dsql ON REPLACE(REPLACE(REPLACE(m.definition,CHAR(32),'()'),')(',''),'()',CHAR(32)) like '%' + dsql.ProcToExecuteDynSQL + '%')

If any procedures or functions are returned that are not documented, this is a finding.

Check Content Reference

M

Target Key

5711