CVE-2024-21391 Overview
CVE-2024-21391 is a remote code execution vulnerability in the Microsoft Windows Data Access Components (WDAC) OLE DB provider for SQL Server. The flaw allows an unauthenticated network-based attacker to execute arbitrary code on a vulnerable Windows host when a user is convinced to connect to a malicious SQL Server. Microsoft tracks the underlying weakness as a numeric truncation error [CWE-197].
The vulnerability affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2008 through 2022 23H2. Microsoft published the advisory on February 13, 2024 as part of its monthly security update cycle.
Critical Impact
Successful exploitation grants the attacker code execution in the context of the targeted user, leading to full compromise of confidentiality, integrity, and availability of the affected host.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-02-13 - CVE-2024-21391 published to the National Vulnerability Database
- 2024-02-13 - Microsoft releases security update addressing the vulnerability
- 2024-11-21 - Last updated in the NVD database
Technical Details for CVE-2024-21391
Vulnerability Analysis
The vulnerability resides in the WDAC OLE DB provider for SQL Server, a client-side database connectivity component bundled with Windows. The provider mishandles data returned from a remote SQL Server, leading to memory corruption that can be steered into arbitrary code execution. Microsoft classifies the root weakness as a numeric truncation error [CWE-197], where an oversized integer value is reduced to a smaller type and used in subsequent memory operations.
Exploitation requires user interaction. A targeted user must be induced to initiate a connection to an attacker-controlled SQL Server endpoint, for example through a crafted connection string, ODBC data source, or an application that automatically authenticates to a remote database. Once the malicious server responds with crafted protocol data, the truncation defect is triggered inside the client process.
The EPSS score of 2.27% places this CVE in the 84th percentile for likelihood of exploitation activity within 30 days, despite no public proof-of-concept being available.
Root Cause
The defect is a numeric truncation error in how the OLE DB provider parses tabular data stream (TDS) responses from a SQL Server. Length or size fields received from the server are converted between integer widths without sufficient validation. A value crafted to overflow during truncation causes downstream buffer arithmetic to allocate or copy memory incorrectly, corrupting adjacent structures.
Attack Vector
The attack vector is network-based but client-initiated. The attacker hosts a malicious server that impersonates SQL Server and waits for an inbound connection from a vulnerable client. Delivery typically involves phishing, malicious documents containing data connections, or compromised internal applications that issue OLE DB queries against attacker-controlled hostnames. Because no privileges are required on the target, any user that establishes the connection is sufficient to trigger code execution at the user's privilege level.
No verified public exploit code is available for CVE-2024-21391. Technical implementation details are restricted to the Microsoft CVE-2024-21391 Advisory.
Detection Methods for CVE-2024-21391
Indicators of Compromise
- Outbound TCP connections from workstations to untrusted hosts on port 1433 or other SQL Server ports, particularly to external IP ranges.
- Unexpected child processes spawned by Office applications, mshta.exe, wscript.exe, or other clients that load msado15.dll or sqloledb.dll.
- Process crashes or Windows Error Reporting events referencing the OLE DB provider modules following an outbound database connection.
- Newly created .udl, .odc, or connection-string files referencing unknown SQL Server hostnames.
Detection Strategies
- Monitor for processes loading WDAC OLE DB modules (msado15.dll, oledb32.dll, sqloledb.dll, msoledbsql.dll) that subsequently spawn shell or scripting interpreters.
- Hunt for anomalous TDS protocol traffic egressing user subnets, especially to hosts that do not appear in approved database inventory.
- Alert on Office or browser processes initiating outbound SQL Server connections, which is uncommon in most environments.
Monitoring Recommendations
- Enable Windows Defender Application Control and Sysmon Image Load (Event ID 7) and Network Connect (Event ID 3) logging for endpoints handling database connectivity.
- Forward endpoint and network telemetry into a centralized analytics platform to correlate OLE DB module loads with outbound SQL traffic and downstream process creation.
- Maintain an allowlist of approved internal SQL Server hostnames and IP ranges, and alert on connections that fall outside this baseline.
How to Mitigate CVE-2024-21391
Immediate Actions Required
- Apply the February 2024 Microsoft security update for all affected Windows 10, Windows 11, and Windows Server versions identified in the advisory.
- Inventory hosts that use the WDAC OLE DB provider for SQL Server and prioritize patching for systems exposed to user-driven database connectivity.
- Restrict outbound traffic on SQL Server ports (1433/TCP and configured alternates) at perimeter and segmentation firewalls to approved destinations only.
- Reinforce phishing awareness training, focusing on file types and links that initiate database connections such as .udl, .odc, and Office data connections.
Patch Information
Microsoft addressed CVE-2024-21391 in the February 13, 2024 security updates. Refer to the Microsoft CVE-2024-21391 Advisory for the complete list of KB articles and update packages corresponding to each Windows build.
Workarounds
- Block outbound SQL Server protocol traffic from endpoints that have no business requirement to reach external database servers.
- Disable or remove OLE DB data sources and Office data connection features in environments where they are not required, using Group Policy.
- Apply application control policies to prevent untrusted processes from loading the OLE DB provider DLLs until patches are deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
