CVE-2024-29047: Microsoft SQL Server 2019 RCE Vulnerability

CVE-2024-29047 Overview

CVE-2024-29047 is a remote code execution vulnerability in the Microsoft OLE DB Driver for SQL Server. The flaw maps to [CWE-122] heap-based buffer overflow in the client-side driver component used by applications to connect to SQL Server. An attacker who controls a malicious SQL Server endpoint can execute arbitrary code on a client that connects to it. Successful exploitation requires user interaction, typically convincing a user or application to connect to an attacker-controlled database server. The vulnerability affects environments running Microsoft SQL Server 2019 and 2022 on x64 platforms.

Critical Impact

Successful exploitation enables remote code execution on the client system with the privileges of the application invoking the OLE DB Driver, resulting in full confidentiality, integrity, and availability impact.

Affected Products

• Microsoft SQL Server 2019 (x64)
• Microsoft SQL Server 2022 (x64)
• Microsoft OLE DB Driver for SQL Server (client component)

Discovery Timeline

• 2024-04-09 - CVE-2024-29047 published to NVD as part of Microsoft's April 2024 Patch Tuesday
• 2025-01-15 - Last updated in NVD database

Technical Details for CVE-2024-29047

Vulnerability Analysis

The vulnerability resides in the Microsoft OLE DB Driver for SQL Server, a client-side component used by applications to communicate with SQL Server instances. The driver mishandles data received from a SQL Server during the connection or query response handling sequence. This mishandling produces a heap-based buffer overflow [CWE-122] in the client process. An attacker-controlled SQL Server can craft response data that overflows a heap allocation in the driver, corrupting adjacent memory.

Exploitation occurs over the network and does not require authentication on the client side. However, it requires user interaction, meaning a user or application must initiate a connection to the attacker-controlled server. Common scenarios include phishing a user into opening a database connection from a tool such as Excel, Power BI, SQL Server Management Studio, or any custom application using the driver.

Root Cause

The root cause is improper validation of length or size fields in server-supplied response data within the OLE DB Driver. When the driver allocates a heap buffer based on attacker-influenced metadata, oversized payload content writes beyond the bounds of the allocation. Heap corruption of this type can be leveraged to overwrite function pointers or virtual table entries reachable by the driver, enabling control over execution flow.

Attack Vector

The attack vector is network-based and exploits the trust relationship between client applications and SQL Server endpoints. An attacker stands up a malicious server that mimics the Tabular Data Stream protocol used by SQL Server. The attacker then induces a victim to connect by distributing a crafted connection string, an Office document with an external data source, or a malicious shortcut. When the victim's OLE DB Driver processes the malicious response, the heap overflow triggers and the attacker's payload executes in the context of the calling application. Public proof-of-concept code is not available for this CVE, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

For technical details, see the Microsoft CVE-2024-29047 Advisory.

Detection Methods for CVE-2024-29047

Indicators of Compromise

• Outbound TCP connections from workstations or application servers to unexpected external endpoints on port 1433 or other SQL Server ports
• Crash dumps or Windows Error Reporting events naming msoledbsql.dll or oledb32.dll in the faulting module field
• Unexpected child processes spawned by Office applications, sqlcmd.exe, ssms.exe, or custom line-of-business apps that use the OLE DB Driver
• Office documents or .udl, .odc, or .dsn files containing connection strings referencing untrusted hosts

Detection Strategies

• Hunt for process executions where parent processes such as excel.exe, powerbi.exe, or ssms.exe spawn shells (cmd.exe, powershell.exe) or LOLBins shortly after a network connection on SQL Server ports
• Inspect outbound SQL Server traffic to non-corporate IP ranges and flag connections to newly registered or low-reputation domains
• Correlate application crashes referencing the OLE DB Driver with preceding network activity to external SQL endpoints

Monitoring Recommendations

• Enable Windows Event Log forwarding for Application Error events and process creation events with command-line auditing
• Monitor egress firewall logs for TCP/1433, TCP/1434, and dynamic SQL ports leaving the corporate perimeter
• Track installed versions of msoledbsql.dll across the fleet and alert on hosts running unpatched builds

How to Mitigate CVE-2024-29047

Immediate Actions Required

• Apply the Microsoft security update for the OLE DB Driver for SQL Server referenced in the Microsoft CVE-2024-29047 Advisory to all systems with the driver installed
• Inventory clients and servers that have msoledbsql.dll installed, including developer workstations and ETL servers, since the vulnerable component is the client driver rather than the SQL Server engine itself
• Block outbound connections to SQL Server ports (1433/1434 and dynamic ranges) from endpoints that have no legitimate need to reach external databases

Patch Information

Microsoft released an updated Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) that corrects the heap buffer overflow. The patch is distributed via the Microsoft Update Catalog and the Microsoft CVE-2024-29047 Advisory. Update the driver on every host that installs it, including hosts where SQL Server tooling, Power BI Desktop, SSMS, or third-party applications bundle the driver. Verify msoledbsql.dll file version after deployment.

Workarounds

• Restrict client systems to connecting only to approved internal SQL Server hostnames or IP ranges through host-based firewall rules
• Train users to avoid opening Office documents, .udl, or .odc files from untrusted sources that may contain external SQL Server data connections
• Where the OLE DB Driver is not required, uninstall it to remove the vulnerable component entirely

# Verify installed OLE DB Driver version on Windows hosts
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\MSOLEDBSQL" | Select-Object InstalledVersion

# Block outbound SQL traffic to non-corporate destinations
New-NetFirewallRule -DisplayName "Block Outbound SQL" `
    -Direction Outbound -Protocol TCP -RemotePort 1433,1434 `
    -RemoteAddress Internet -Action Block