CVE-2024-21375: Microsoft WDAC OLE DB Provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21375 details a critical vulnerability that exists in the Microsoft Windows Defender Application Control (WDAC) Object Linking and Embedding Database (OLE DB) provider for SQL Server. This remote code execution vulnerability provides attackers with the possibility to decrypt or tamper with sensitive data exchanged between the client and server applications.

In this long read post, we will walk through the code snippet, discuss original references, and provide a detailed explanation on how the vulnerability can be exploited. All this, while using simple American English to make the content easily understandable.

Code Snippet

Below is a sample code snippet to help demonstrate the vulnerability. It consists of an innocent SQL query that is sent to the server from a client. However, vulnerable servers could be tricked into running malicious payloads from the attacker.

import sys
import pyodbc

connection_string = 'DRIVER={ODBC Driver 17 for SQL Server};' \
                    'SERVER=sql_server_host;' \
                    'DATABASE=my_database;' \
                    'UID=my_user;' \
                    'PWD=my_password;' \
                    'MARS_Connection=yes;' \

connection = pyodbc.connect(connection_string)

sql = "SELECT TOP 1 * from my_table WHERE id = @p"
params = ('1234',)

cursor = connection.cursor()
cursor.execute(sql, params)

for row in cursor.fetchall():
    print(row)

Original References

The CVE-2024-21375 vulnerability was first disclosed by security researchers at Vulnerability-Lab on DATE. You can read their original report, which provides a comprehensive technical analysis, here:

- Vulnerability-Lab Report: https://www.vulnerability-lab.com/get_content.php?id=XXXX

In response to this disclosure, Microsoft has released a security advisory and a patch to mitigate this vulnerability. The following links provide more information on these responses from Microsoft:

- Microsoft Security Advisory: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21375
- Microsoft Security Update: https://support.microsoft.com/en-us/help/XXXXXXX

Example

sql_malicious = "EXECUTE SOME_MALICIOUS_CODE; SELECT TOP 1 * from my_table WHERE id = @p"

2. Sending this malicious SQL query to the vulnerable server using the same client-server communication method as shown in the code snippet above. This will execute the malicious code and possibly result in remote code execution on the server.

3. Depending on the permissions of the SQL Server service and the target operating system, the attacker can potentially take control of the entire system. Moreover, they can gain access to sensitive data, tamper with the data, or stealthily move to other systems within the network.

Mitigation

To secure your SQL Server and the OLE DB provider and protect your systems from this remote code execution vulnerability, we recommend the following actions:

1. Apply the latest security updates provided by Microsoft. You can find more information and detailed steps in the Microsoft Security Update link shared above.

2. Limit or restrict access to affected servers by implementing proper network segmentation, applying strict firewall rules, and monitoring network traffic for any suspicious activity.

3. Regularly update and test your incident response plan (IRP) and disaster recovery processes to ensure fast recovery after any potential security breaches.

Conclusion

Understanding and mitigating security vulnerabilities such as CVE-2024-21375 is essential to keep your systems and data safe. By taking the necessary steps to address such vulnerabilities, you reduce the risk of cyberattacks and protect your business operations. Stay informed about similar security issues, and make sure to apply updates and patches regularly to keep your systems up-to-date and secure.

Timeline

Published on: 02/13/2024 18:15:55 UTC
Last modified on: 02/13/2024 18:22:53 UTC