*Published June 2024*

Summary

A critical security issue, tracked as CVE-2024-29985, was discovered in Microsoft OLE DB Driver for SQL Server. This vulnerability allows remote attackers to execute arbitrary code on vulnerable systems by sending specially crafted connection requests. The flaw, with a CVSS score of 8.8 (High), is a major risk for servers running the affected OLE DB Driver, especially those exposed to untrusted networks.

This post explains how the vulnerability works, provides sample code snippets of the exploitation technique, includes references to Microsoft’s advisory, and offers mitigation tips.

What is CVE-2024-29985?

CVE-2024-29985 is a remote code execution (RCE) vulnerability in the OLE DB Driver for SQL Server—software that allows client apps to access SQL Server databases using OLE DB interfaces. Attackers abusing this flaw can run code on the server in the context of the service calling the OLE DB driver, which is often highly privileged.

Official Microsoft advisory:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29985

How Does the Vulnerability Work?

Researchers discovered that the OLE DB Driver fails to properly validate input when processing specially crafted connection strings. This can lead to memory corruption and opens the door to remote code execution if an attacker can trick the system into loading malicious content.

Attacker crafts a malicious connection string that abuses the vulnerable parsing logic.

2. Victim app/server uses the OLE DB Driver to process the string—for example, via a web app or an API.
3. The malicious string triggers memory corruption, allowing the attacker to execute their code on the server.

Exploit Details (Demonstration)

Below is a conceptual Python snippet showing how an attacker might exploit CVE-2024-29985 in a vulnerable environment. (Note: *This is for educational purposes ONLY. Do NOT use in production!*)

Let's assume a web app takes connection string input from a user (security anti-pattern!) and passes it to OLE DB:

import pyodbc

# ATTACK: Malicious connection string
malicious_conn_str = "Provider=MSOLEDBSQL;Data Source=localhost;Initial Catalog=master;UID=sa;PWD=Password123;App=’;SomeEFProperty=evil_payload.dll;--"

try:
    # The vulnerable code that uses untrusted input
    conn = pyodbc.connect(malicious_conn_str)
    cursor = conn.cursor()
    cursor.execute("SELECT @@version;")
    print(cursor.fetchone())
except Exception as e:
    print(f"Error: {e}")

The attacker injects unexpected properties or payload paths into the connection string that can cause the driver to mishandle memory or load malicious DLLs. On vulnerable drivers, this can cause remote code execution.

Gain remote access to the server

- Run any code (with system/service privileges)

Spread to other networked systems

Public exploit code has not surfaced as of June 2024, but exploitability is considered high, especially in hosted environments.

Official CVE Page:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29985

Security Update Downloads:

https://docs.microsoft.com/en-us/sql/connect/oledb/download-oledb-driver-for-sql-server

Download and install the latest fixed version from Microsoft.

OLE DB Driver for SQL Server Download Page

Never pass user input directly as a connection string.

3. Restrict network access to apps/services using the OLE DB Driver.

Final Thoughts

CVE-2024-29985 is a dangerous RCE bug in a critical Microsoft database driver. Its impact makes patching urgent for anyone running affected versions. Always validate input, keep dependencies up-to-date, and monitor your perimeter for unusual connection activity.

For further technical deep dives and proof-of-concept releases, keep an eye on trusted sources

- Microsoft Security Blog
- Rapid7 Blog
- CVE Details


*Stay safe, keep patching, and never trust user input!*

Timeline

Published on: 04/09/2024 17:16:01 UTC
Last modified on: 04/10/2024 13:24:00 UTC