CVE-2024-21358: Windows 10 1507 WDAC RCE Vulnerability

CVE-2024-21358 Overview

CVE-2024-21358 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) Object Linking and Embedding Database (OLE DB) provider for SQL Server. The flaw affects supported releases of Windows 10, Windows 11, and Windows Server from 2008 through 2022 23H2. An unauthenticated attacker on the network can execute arbitrary code in the context of the vulnerable client when a user is convinced to connect to an attacker-controlled SQL Server instance. The vulnerability is associated with CWE-122 (heap-based buffer overflow) and carries a CVSS 3.1 score of 8.8.

Critical Impact

Successful exploitation allows arbitrary code execution on the targeted client with full confidentiality, integrity, and availability impact, enabling lateral movement from a malicious SQL Server connection.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2, 22H2, 23H2)
• Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-02-13 - CVE-2024-21358 published to the National Vulnerability Database
• 2024-02-13 - Microsoft released a security update through the Microsoft Security Response Center
• 2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2024-21358

Vulnerability Analysis

The vulnerability resides in the WDAC OLE DB provider for SQL Server (MSOLEDBSQL/SQLOLEDB), the legacy data-access component used by Windows applications to connect to SQL Server. The provider mishandles data returned during a client-server exchange, leading to a heap-based buffer overflow on the client side. An attacker who controls a malicious SQL Server instance can return crafted protocol responses that corrupt memory within the calling process. The flaw requires user interaction, meaning the victim must initiate a connection to the rogue server, typically through a phishing lure or a manipulated connection string.

Root Cause

The root cause is improper validation of server-supplied data within the OLE DB provider's parsing routines, classified under CWE-122. Untrusted bytes received over the Tabular Data Stream (TDS) protocol are copied into heap buffers without sufficient size enforcement. The overflow corrupts adjacent heap metadata and structures, which an attacker can shape to redirect execution.

Attack Vector

Exploitation requires the victim to connect to an attacker-controlled SQL Server endpoint using an affected version of the OLE DB provider. The attacker hosts a rogue server that responds to the client's connection handshake with malicious TDS packets. Once parsed by the client, the crafted response triggers the heap overflow and yields code execution in the security context of the application initiating the connection. No prior authentication is required on the attacker's side, and the attack succeeds over standard SQL Server network ports.

No public proof-of-concept code is referenced in the NVD record. Technical details are described in the Microsoft advisory: Microsoft CVE-2024-21358 Update.

Detection Methods for CVE-2024-21358

Indicators of Compromise

• Outbound TDS connections from workstations or servers to untrusted external IP addresses on TCP/1433 or dynamic SQL Server ports.
• Unexpected child processes spawned by applications that load msoledbsql.dll or sqloledb.dll.
• Crash dumps of OLE DB consumer processes showing access violations in heap allocator routines following a SQL Server connection attempt.

Detection Strategies

• Monitor process telemetry for binaries loading the OLE DB SQL provider DLLs and immediately spawning shells, scripting hosts, or LOLBins such as rundll32.exe or powershell.exe.
• Hunt for SQL client connections initiated by user-facing applications (Office, browsers, mail clients) that would not normally communicate with SQL Server.
• Correlate phishing-related email activity with subsequent outbound SQL Server connections to internet-hosted endpoints.

Monitoring Recommendations

• Enable command-line, image-load, and network-connection auditing on Windows endpoints to capture provider DLL usage and TDS traffic.
• Centralize endpoint and network telemetry in a SIEM and alert on anomalous SQL Server destinations outside the corporate environment.
• Track Microsoft patch compliance for the February 2024 cumulative updates across all affected Windows builds.

How to Mitigate CVE-2024-21358

Immediate Actions Required

• Apply the Microsoft security updates released for the February 2024 Patch Tuesday cycle to every affected Windows 10, Windows 11, and Windows Server build.
• Inventory hosts using the WDAC OLE DB provider for SQL Server and prioritize patching for systems that initiate outbound SQL connections.
• Educate users to avoid opening untrusted database connection links or files that may trigger SQL Server client connections to external hosts.

Patch Information

Microsoft addressed CVE-2024-21358 in the February 13, 2024 security updates. Refer to the official advisory for the per-product Knowledge Base article and update package: Microsoft CVE-2024-21358 Update.

Workarounds

• Block outbound TCP/1433 and SQL Browser UDP/1434 traffic at the perimeter firewall for hosts that do not require external SQL Server connectivity.
• Restrict execution of applications that rely on the legacy OLE DB provider until updates are applied.
• Enforce egress filtering and DNS controls to prevent connections to attacker-controlled SQL Server endpoints.

# Example: block outbound SQL Server traffic on a Windows host via Windows Firewall
New-NetFirewallRule -DisplayName "Block Outbound SQL 1433" -Direction Outbound `
    -Protocol TCP -RemotePort 1433 -Action Block

New-NetFirewallRule -DisplayName "Block Outbound SQL Browser 1434" -Direction Outbound `
    -Protocol UDP -RemotePort 1434 -Action Block