CVE-2024-21368: Windows 10 1507 WDAC RCE Vulnerability

CVE-2024-21368 Overview

CVE-2024-21368 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) OLE DB provider for SQL Server. The flaw affects supported versions of Windows 10, Windows 11, and Windows Server. An attacker who successfully exploits the vulnerability can execute arbitrary code in the context of the targeted user. Exploitation requires user interaction, typically by convincing a victim to connect to a malicious SQL Server instance. Microsoft addressed the issue in the February 2024 security update cycle. The vulnerability is categorized as a heap-based buffer overflow [CWE-122].

Critical Impact

Successful exploitation enables remote code execution on the victim host with the privileges of the user running the vulnerable OLE DB client application.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (21H2, 22H2, 23H2)
• Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2
• Applications using the WDAC OLE DB Provider for SQL Server (MSOLEDBSQL)

Discovery Timeline

• 2024-02-13 - CVE-2024-21368 published to NVD
• 2024-02-13 - Microsoft releases security patch via Patch Tuesday advisory
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21368

Vulnerability Analysis

The vulnerability resides in the OLE DB provider component used by Windows applications to communicate with Microsoft SQL Server. The provider parses Tabular Data Stream (TDS) responses returned by a SQL Server instance. A malformed server response triggers a heap-based buffer overflow [CWE-122] in the client. The attacker must convince a user to initiate or accept a connection to an attacker-controlled SQL Server endpoint. Once the client processes the crafted response, the overflow corrupts heap memory and can hijack control flow. Code execution occurs in the security context of the application that loaded the OLE DB provider.

Root Cause

The root cause is improper validation of length fields within TDS protocol responses. The provider allocates a fixed-size heap buffer and copies attacker-controlled data without sufficient bounds checking. This produces a classic heap buffer overflow exploitable for arbitrary code execution.

Attack Vector

The attack is network-based but requires user interaction. A typical scenario involves social engineering a user into opening a document, launching an application, or following a connection string that points to a malicious SQL Server. The attacker hosts a rogue server that returns crafted TDS packets to the victim client. Authentication is not required on the client side because the overflow occurs during connection establishment and response parsing.

No verified public proof-of-concept exploit code is available for CVE-2024-21368. Refer to the Microsoft CVE-2024-21368 Advisory for vendor technical details.

Detection Methods for CVE-2024-21368

Indicators of Compromise

• Outbound TCP connections from end-user workstations to untrusted SQL Server endpoints on port 1433 or non-standard ports
• Unexpected child processes spawned by applications that load MSOLEDBSQL.DLL or oledb32.dll
• Crash events or Windows Error Reporting entries referencing the OLE DB provider modules after connecting to external hosts

Detection Strategies

• Monitor process telemetry for OLE DB client applications loading the SQL Server provider followed by suspicious memory allocations or code execution
• Hunt for SQL Server connection attempts from user endpoints to IP addresses outside the enterprise database subnets
• Inspect command-line arguments and connection strings within Office macros, scripts, and .udl files for references to untrusted servers

Monitoring Recommendations

• Alert on creation of .udl files or modification of ODBC data source registry keys under HKLM\SOFTWARE\ODBC and HKCU\SOFTWARE\ODBC
• Log and review egress traffic to TDS ports from non-developer endpoints
• Correlate WDAC OLE DB provider crashes with subsequent process injection or persistence behavior

How to Mitigate CVE-2024-21368

Immediate Actions Required

• Apply the February 2024 Microsoft security updates to all affected Windows client and server systems
• Inventory hosts with the WDAC OLE DB provider installed and prioritize patching for workstations that initiate SQL connections
• Block outbound TDS traffic (TCP 1433 and configured SQL ports) from user workstations to untrusted destinations at the perimeter firewall

Patch Information

Microsoft released fixes through the February 13, 2024 security update. Administrators should consult the Microsoft CVE-2024-21368 Advisory for the specific KB articles corresponding to each affected Windows build and deploy them via Windows Update, WSUS, or Microsoft Update Catalog.

Workarounds

• Restrict SQL Server client connectivity to known internal database servers via host-based firewall rules
• Disable or remove the WDAC OLE DB provider on systems that do not require SQL Server connectivity
• Train users to refuse connection prompts and avoid opening connection files (.udl, .odc) received from untrusted sources

# Example: block outbound SQL Server connections from a workstation except to approved hosts
New-NetFirewallRule -DisplayName "Block-Outbound-TDS" -Direction Outbound \
  -Protocol TCP -RemotePort 1433 -Action Block -Profile Any

New-NetFirewallRule -DisplayName "Allow-Approved-SQL" -Direction Outbound \
  -Protocol TCP -RemotePort 1433 -RemoteAddress 10.10.20.0/24 -Action Allow -Profile Any