CVE-2024-37331: SQL Server 2016 RCE Vulnerability

CVE-2024-37331 Overview

CVE-2024-37331 is a remote code execution vulnerability in the Microsoft SQL Server Native Client OLE DB Provider. The flaw affects multiple supported releases of Microsoft SQL Server and is tracked under [CWE-122] (Heap-based Buffer Overflow). Successful exploitation allows an attacker to execute arbitrary code in the context of the targeted client application after a user is convinced to connect to a malicious SQL Server instance.

Microsoft published the advisory on July 9, 2024. The vulnerability is network-attackable but requires user interaction, placing the exploitation burden on social engineering or attacker-controlled connection strings.

Critical Impact
A successful attack yields full code execution with the privileges of the connecting client, enabling lateral movement, credential theft, and persistence on systems that initiate OLE DB connections to attacker-controlled SQL Servers.

Affected Products

Microsoft SQL Server 2016
Microsoft SQL Server 2017
Microsoft SQL Server 2019
Microsoft SQL Server 2022

Discovery Timeline

2024-07-09 - CVE-2024-37331 published to NVD
2024-07-09 - Microsoft released the security update via the Microsoft CVE-2024-37331 Advisory
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37331

Vulnerability Analysis

The vulnerability resides in the SQL Server Native Client OLE DB Provider (SQLNCLI/MSOLEDBSQL), which clients use to connect to SQL Server instances. The provider mishandles data returned from a remote SQL Server during the connection or query response stage, producing a heap-based buffer overflow [CWE-122].

An attacker who controls the server side of an OLE DB connection can return crafted response data that overflows a heap allocation in the client process. The corrupted heap state allows the attacker to execute arbitrary code within the client application that initiated the connection.

Because the trust boundary is reversed from the typical SQL injection model, the risk extends to any Windows application, service, or scheduled job that uses the OLE DB provider to connect to an external SQL Server.

Root Cause

The root cause is improper validation of length or size fields in server-supplied data structures processed by the OLE DB provider. The provider allocates a heap buffer based on assumed bounds and then writes attacker-controlled bytes beyond the allocation. The condition aligns with [CWE-122] and produces deterministic memory corruption rather than a denial of service.

Attack Vector

Exploitation requires a victim with the affected OLE DB provider installed to initiate a connection to a malicious SQL Server endpoint. Attackers can deliver the trigger through phishing links containing crafted ODBC/OLE DB connection strings, malicious Office documents that establish external data connections, or compromised internal SQL Server hosts that respond with the malicious payload.

The vulnerability operates over the standard SQL Server network protocol (TDS) on TCP port 1433 or any configured port. No authentication is required against the malicious server because the attacker controls it. The user interaction requirement is satisfied as soon as the victim triggers the outbound connection.

No public proof-of-concept code or in-the-wild exploitation has been confirmed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-37331

Indicators of Compromise

Outbound TDS connections from workstations or application servers to unexpected external IP addresses on TCP port 1433 or other SQL Server ports.
Unexpected child processes spawned by applications that host MSOLEDBSQL.DLL or SQLNCLI11.DLL, such as Excel, Power BI, SSMS, or custom .NET services.
Crash events or heap corruption exceptions logged for processes loading the SQL Server Native Client OLE DB Provider.

Detection Strategies

Inventory all hosts with the SQL Server Native Client or MSOLEDBSQL provider installed and correlate with the patch status reported by Microsoft Update.
Hunt for OLE DB connection strings referencing external or untrusted SQL Server hostnames in document data connections, Power Query files, and ODBC DSN configurations.
Apply behavioral analytics that flag sqlservr.exe-bound traffic originating from non-database workloads such as user endpoints or web browsers.

Monitoring Recommendations

Forward Windows Application and System event logs to a central SIEM and alert on faulting modules msoledbsql.dll, sqlncli11.dll, or sqlnclir11.rll.
Monitor egress firewall logs for SQL Server protocol traffic destined for IP ranges outside approved database segments.
Track process-creation telemetry for code execution chains where Office or browser processes spawn cmd.exe, powershell.exe, or rundll32.exe shortly after loading the OLE DB provider.

How to Mitigate CVE-2024-37331

Immediate Actions Required

Apply the July 2024 Microsoft security updates for all supported SQL Server releases listed in the advisory.
Update the standalone Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL) on client systems, not only on database servers, because the vulnerable code executes in the client process.
Restrict outbound TCP 1433 and other SQL Server ports at the perimeter to block client connections to attacker-controlled servers.

Patch Information

Microsoft released cumulative updates and GDR packages addressing CVE-2024-37331 across SQL Server 2016, 2017, 2019, and 2022. Refer to the Microsoft CVE-2024-37331 Advisory for the specific KB numbers, build versions, and download links applicable to each supported SQL Server release and OLE DB Driver version.

Workarounds

Where patching cannot occur immediately, block outbound SQL Server protocol traffic from user workstations using host-based or network firewalls.
Disable or remove the legacy SQL Server Native Client (SQLNCLI11) on systems that do not require it, and migrate applications to the supported and patched MSOLEDBSQL driver.
Disable external data connections in Microsoft Office through Group Policy to reduce the phishing-based delivery surface.

bash

# Example: Block outbound SQL Server traffic from endpoints using Windows Firewall
New-NetFirewallRule -DisplayName "Block Outbound SQL Server TDS" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 1433,1434 `
  -Action Block `
  -Profile Any