CVE-2024-21369: Windows 10 1507 WDAC RCE Vulnerability

CVE-2024-21369 Overview

CVE-2024-21369 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) OLE DB provider for SQL Server. The flaw is classified as a heap-based buffer overflow [CWE-122] and affects supported Windows client and server releases. An attacker who convinces a target user to connect to a malicious SQL Server instance can execute arbitrary code in the context of the user. Microsoft published the advisory on February 13, 2024, and the issue carries a CVSS 3.1 base score of 8.8.

Critical Impact

Successful exploitation results in remote code execution on the targeted Windows host with the privileges of the user invoking the OLE DB connection, enabling full compromise of confidentiality, integrity, and availability.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2) and Windows 11 (21H2, 22H2, 23H2)
• Microsoft Windows Server 2008 SP2 and 2008 R2
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-02-13 - CVE-2024-21369 published to NVD
• 2024-02-13 - Microsoft releases security update via MSRC advisory
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21369

Vulnerability Analysis

The vulnerability resides in the WDAC OLE DB provider for SQL Server, a client-side data access component shipped with Windows. The provider mishandles server response data during connection processing, leading to a heap-based buffer overflow [CWE-122]. An attacker controlling a malicious SQL Server endpoint can return crafted protocol messages that overflow a heap buffer in the client process. The result is arbitrary code execution in the context of the connecting application. Because the affected component is part of the Windows base operating system, exploitation does not require additional third-party software on the victim host.

Root Cause

The root cause is improper validation of attacker-controlled length or structure fields in network data parsed by the OLE DB provider. When the provider allocates or writes to a heap buffer based on these untrusted values, it writes past the bounds of the allocation. Adjacent heap metadata or function pointers can then be corrupted, enabling control-flow hijacking. The advisory categorizes the weakness under CWE-122 (Heap-based Buffer Overflow).

Attack Vector

Exploitation requires user interaction. An attacker must convince an authenticated user to initiate a database connection to an attacker-controlled SQL Server, for example through a malicious connection string, a phishing lure containing an .udl file, or an application that connects to a server reachable by the attacker. Once the client connects, the malicious server returns crafted protocol responses that trigger the overflow. The attack is network-based with low complexity and requires no prior privileges on the target.

No public proof-of-concept code or in-the-wild exploitation has been reported for this CVE at the time of writing. See the Microsoft Security Advisory CVE-2024-21369 for vendor technical details.

Detection Methods for CVE-2024-21369

Indicators of Compromise

• Outbound TCP connections from end-user workstations to untrusted SQL Server endpoints on port 1433 or non-standard SQL ports.
• Unexpected child processes spawned by Office, browser, or scripting hosts following the opening of .udl, .odc, or .rdp files.
• Crash dumps or Windows Error Reporting events referencing msdasql.dll, sqloledb.dll, or oledb32.dll in user-mode processes.

Detection Strategies

• Hunt for processes loading the OLE DB provider modules and immediately establishing external SQL Server connections to non-corporate IP ranges.
• Alert on Tabular Data Stream (TDS) traffic egressing the corporate perimeter to unapproved destinations.
• Correlate user-interaction events (file opens, link clicks) with subsequent network connections to SQL endpoints.

Monitoring Recommendations

• Enable command-line and module-load auditing on endpoints to capture invocations of OLE DB-consuming binaries.
• Forward Sysmon Event IDs 1, 3, 7, and 11 to a centralized SIEM for correlation across user, process, and network telemetry.
• Monitor MSRC advisory updates for revisions to CVE-2024-21369 and adjust detection content accordingly.

How to Mitigate CVE-2024-21369

Immediate Actions Required

• Apply the February 2024 Microsoft security updates referenced in the MSRC advisory to all affected Windows client and server systems.
• Inventory hosts running unsupported builds such as Windows Server 2008 and confirm they receive ESU updates or are decommissioned.
• Restrict outbound SQL Server connectivity from user workstations to known internal database hosts using host or network firewalls.

Patch Information

Microsoft addressed CVE-2024-21369 in cumulative updates released on February 13, 2024. Patch identifiers vary by Windows version and are listed on the Microsoft Security Advisory CVE-2024-21369 page. Administrators should validate deployment through Windows Update for Business, WSUS, or Microsoft Intune reporting.

Workarounds

• Block outbound TCP 1433 and other SQL Server ports at the perimeter for endpoints that do not require direct database connectivity.
• Disable or remove unused OLE DB data sources and .udl file associations on user workstations until patches are applied.
• Enforce least privilege so that users connecting to databases run without local administrator rights, limiting the impact of code execution.

# Verify the February 2024 cumulative update is installed (PowerShell)
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date '2024-02-13') } | \
  Select-Object HotFixID, Description, InstalledOn