CVE-2024-21361: Windows 10 1507 WDAC RCE Vulnerability

CVE-2024-21361 Overview

CVE-2024-21361 is a remote code execution vulnerability in the Microsoft WDAC OLE DB provider for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122]. An attacker can exploit the vulnerability by convincing a user to connect to a malicious SQL Server instance, which then returns crafted responses that trigger memory corruption on the client. Successful exploitation results in arbitrary code execution in the context of the connecting user. The vulnerability affects a wide range of Windows client and server editions, including supported releases of Windows 10, Windows 11, and Windows Server from 2008 through 2022 23H2.

Critical Impact
Successful exploitation allows network-based remote code execution on the victim client with high impact to confidentiality, integrity, and availability, requiring only user interaction with a malicious SQL Server endpoint.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-02-13 - CVE-2024-21361 published to NVD
2024-02-13 - Microsoft releases security patch via Patch Tuesday update guide
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21361

Vulnerability Analysis

The vulnerability resides in the Windows Data Access Components (WDAC) OLE DB provider for SQL Server (MSOLEDBSQL/SQLOLEDB). The component fails to safely handle data structures returned by a SQL Server endpoint during a client session. A malicious server can return specially crafted Tabular Data Stream (TDS) responses that cause the provider to write beyond an allocated heap buffer. Because the OLE DB provider runs in the address space of the client process, the resulting memory corruption is processed with the privileges of the connecting user.

The attack model requires the user to initiate or be tricked into initiating a database connection to an attacker-controlled server. Typical attack delivery vectors include phishing links that trigger SQL connections from applications such as SQL Server Management Studio, Excel, Power BI, or custom line-of-business tools that rely on OLE DB.

Root Cause

The root cause is improper validation of length and type fields within server-supplied protocol structures before they are copied into a fixed-size heap allocation. This classic heap-based buffer overflow [CWE-122] allows adjacent heap metadata or object pointers to be overwritten, leading to control-flow hijacking through corrupted virtual function tables or freelist entries.

Attack Vector

The attack vector is network-based with low complexity, no privileges required, and user interaction required. An attacker hosts a rogue SQL Server that responds to incoming client connections with malformed TDS packets. When a victim opens a connection — for example by clicking a .udl file, a SQL connection string in an Office document, or a malicious link that launches a database client — the OLE DB provider parses the response and the overflow is triggered. The result is remote code execution in the victim user's session.

No public proof-of-concept exploit is currently available for CVE-2024-21361, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for CVE-2024-21361 for vendor-supplied technical details.

Detection Methods for CVE-2024-21361

Indicators of Compromise

Outbound TCP connections on port 1433 (or non-standard SQL ports) from user workstations to untrusted external IP addresses.
Unexpected child processes spawned from sqlservr.exe clients, Office applications, or Mmc.exe hosting database connection dialogs.
Crash dumps or Windows Error Reporting events referencing msoledbsql.dll, sqloledb.dll, or oledb32.dll with access violation exceptions.
Creation of .udl (Universal Data Link) files in user-writable locations or email attachments containing .udl or ODBC connection files.

Detection Strategies

Monitor process creation events where database client processes load msoledbsql.dll and subsequently spawn shell interpreters such as cmd.exe, powershell.exe, or rundll32.exe.
Hunt for SQL client connections originating from non-administrative user workstations to external networks, especially to IP ranges outside corporate database subnets.
Correlate user-clicked email links or attachments with subsequent OLE DB activity and outbound TDS traffic within a short time window.

Monitoring Recommendations

Enable Windows Defender Exploit Guard and audit-mode ASR rules to log suspicious child process creation from Office and database tools.
Forward Sysmon Event IDs 1 (process create), 3 (network connect), and 7 (image loaded) to a centralized SIEM for correlation against the indicators above.
Track patch deployment state of KB articles referenced in the Microsoft Security Update Guide across the fleet to identify unpatched hosts.

How to Mitigate CVE-2024-21361

Immediate Actions Required

Apply the February 2024 Microsoft security updates for all affected Windows client and server editions listed in the advisory.
Inventory endpoints that have the WDAC OLE DB provider installed and prioritize patching of workstations used by database administrators, analysts, and developers.
Restrict outbound TCP traffic to TDS ports (default 1433) at the perimeter firewall, allowing only approved internal database servers.
Educate users not to open .udl, .odc, or unknown database connection files received via email or web downloads.

Patch Information

Microsoft released cumulative security updates addressing CVE-2024-21361 on 2024-02-13 as part of the monthly security update cycle. The fix is delivered through the standard Windows Update channel for all supported Windows 10, Windows 11, and Windows Server editions. Refer to the Microsoft Security Update Guide for CVE-2024-21361 for the specific KB identifiers that map to each affected build.

Workarounds

Block outbound connections to TCP port 1433 and other configured SQL Server ports from user workstations using host-based or perimeter firewalls until patching is complete.
Disable or uninstall the Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) on systems that do not require client-side SQL connectivity.
Enforce egress filtering so that only approved database client subnets can reach external SQL Server endpoints, eliminating the rogue-server attack path.

bash

# Example: block outbound SQL Server traffic on Windows endpoints until patched
New-NetFirewallRule -DisplayName "Block Outbound TDS 1433" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433 `
  -Action Block `
  -Profile Any