I have another database Ydb accessing data in database Kdb. They both have the same owner.
In order to allow cross database chaining, it seems I need the guest user to be enabled in Kdb.
I did so like this:
USE [master];
GO
ALTER DATABASE Ydb SET DB_CHAINING ON;
ALTER DATABASE Kdb SET DB_CHAINING ON;
GO
USE [Kdb]
GO
GRANT CONNECT TO guest;
I realize this means stored procedures in Ydb created by Ydb's owner may freely access objects in Kdb when created by the same login. What kinds of attacks does this open up?
