CVE-2024-21370: Windows 10 1507 WDAC SQL Server RCE Flaw

CVE-2024-21370 Overview

CVE-2024-21370 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) OLE DB provider for SQL Server. The flaw allows attackers to execute arbitrary code on affected systems when a victim connects to a malicious SQL Server instance. Microsoft disclosed the vulnerability as part of its February 2024 security update cycle. The underlying weakness is a heap-based buffer overflow [CWE-122] that triggers during the processing of crafted server responses. Both client systems and server installations across the supported Windows lineup are affected.

Critical Impact

An attacker who convinces a user to connect to a malicious SQL Server can achieve remote code execution with the privileges of the connecting process, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
• Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-02-13 - CVE-2024-21370 published to NVD
• 2024-02-13 - Microsoft released security update addressing CVE-2024-21370
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21370

Vulnerability Analysis

The vulnerability resides in the WDAC OLE DB provider for SQL Server, the client-side component Windows applications use to connect to SQL Server databases. A malicious SQL Server can return crafted protocol responses that cause the OLE DB provider to write outside the bounds of an allocated heap buffer. The resulting memory corruption can be steered toward controlled code execution in the context of the calling process. Exploitation is network-based but requires the victim to initiate a database connection to attacker-controlled infrastructure.

Root Cause

The root cause is a heap-based buffer overflow [CWE-122] within the data parsing logic of the OLE DB provider. The component fails to correctly validate length or size fields supplied by the remote SQL Server before copying data into a fixed-size heap allocation. An attacker controlling the server response can shape adjacent heap memory and corrupt object metadata or function pointers used during later processing.

Attack Vector

The attack vector is network-based but requires user interaction. The attacker must persuade a user, typically an administrator or developer, to connect a vulnerable client to a malicious SQL Server instance using the WDAC OLE DB provider. Common delivery techniques include phishing emails containing connection strings, malicious .udl or .odc files, or rogue services on internal networks that lure clients via discovery or misconfiguration. No authentication is required at the SQL Server layer because the corruption occurs before authentication completes.

No public proof-of-concept exploit code has been released. See the Microsoft Security Update CVE-2024-21370 advisory for vendor technical details.

Detection Methods for CVE-2024-21370

Indicators of Compromise

• Outbound TCP connections from workstations or servers to unfamiliar SQL Server endpoints on port 1433 or dynamic ports negotiated through SQL Browser on UDP 1434.
• Unexpected child processes spawned by applications hosting OLE DB clients such as excel.exe, powerbi.exe, or custom line-of-business binaries.
• Crash events or Windows Error Reporting entries referencing msolap, msoledbsql, or sqloledb modules.
• Creation or execution of .udl, .odc, or Office documents containing connection strings to external SQL Server hosts.

Detection Strategies

• Hunt for processes loading OLE DB provider DLLs (msoledbsql.dll, sqloledb.dll) that then initiate network connections to non-corporate SQL Server hosts.
• Correlate Sysmon Event ID 3 (network connect) with Event ID 7 (image load) to identify anomalous OLE DB usage patterns.
• Apply behavioral identification on post-exploitation activity such as cmd.exe, powershell.exe, or LOLBin execution descending from Office or BI applications.

Monitoring Recommendations

• Inventory hosts with the OLE DB provider installed and baseline their legitimate SQL Server destinations.
• Monitor egress traffic to TCP/1433 and block connections to internet-based SQL Server hosts at the perimeter.
• Forward endpoint telemetry, DNS logs, and proxy logs to a centralized analytics platform to enable cross-source hunting for malicious connection patterns.

How to Mitigate CVE-2024-21370

Immediate Actions Required

• Apply the February 2024 Microsoft security updates that address CVE-2024-21370 across all affected Windows client and server systems.
• Identify and inventory all workstations and servers running the WDAC OLE DB provider for SQL Server and prioritize patching for hosts used by administrators and developers.
• Restrict outbound connections to TCP/1433 and UDP/1434 at the perimeter firewall to known internal SQL Server hosts only.
• Educate users about the risk of opening connection files (.udl, .odc) or Office documents from untrusted sources.

Patch Information

Microsoft released cumulative security updates on February 13, 2024 that remediate CVE-2024-21370 in the OLE DB provider for SQL Server across supported Windows versions. Refer to the Microsoft Security Update CVE-2024-21370 advisory for the specific KB articles and packages applicable to each platform.

Workarounds

• Block outbound connections from end-user workstations to external SQL Server endpoints using host or network firewall rules until patches are deployed.
• Disable or remove the WDAC OLE DB provider on systems that do not require SQL Server connectivity.
• Enforce application allowlisting to prevent execution of unsigned binaries dropped by post-exploitation payloads.
• Require VPN or private network access for legitimate SQL Server connections, eliminating direct exposure to attacker-controlled servers.

# Example: Restrict outbound SQL Server traffic using Windows Defender Firewall
New-NetFirewallRule -DisplayName "Block Outbound SQL Server (Untrusted)" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433 `
  -RemoteAddress Internet `
  -Action Block