CVE-2024-49043: Microsoft SQL Server 2016 RCE Vulnerability

CVE-2024-49043 Overview

CVE-2024-49043 is a remote code execution vulnerability in Microsoft.SqlServer.XEvent.Configuration.dll, a component shipped with multiple supported releases of Microsoft SQL Server. The flaw is classified under CWE-426: Untrusted Search Path, which allows an attacker to influence which DLL the host process loads at runtime. Exploitation requires local access and user interaction, but a successful attack runs attacker-controlled code in the context of the loading process. Microsoft published guidance and a fix through the Microsoft Security Update Guide.

Critical Impact
An attacker who places a malicious DLL in a path searched by the SQL Server XEvent configuration component can achieve code execution with the privileges of the loading process, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft SQL Server 2016 (x64)
Microsoft SQL Server 2017 (x64)
Microsoft SQL Server 2019 (x64)
Microsoft SQL Server 2022 (x64)

Discovery Timeline

2024-11-12 - CVE-2024-49043 published to NVD
2024-11-12 - Microsoft releases security guidance through the Security Update Guide
2024-11-15 - Last updated in NVD database

Technical Details for CVE-2024-49043

Vulnerability Analysis

The vulnerability resides in Microsoft.SqlServer.XEvent.Configuration.dll, the managed assembly that configures Extended Events (XEvent) sessions for SQL Server. The component resolves a dependent library using an untrusted search path. When a host process loads the affected DLL, Windows searches a sequence of directories for dependencies. An attacker who can write to one of those directories can place a malicious DLL there, and the legitimate process loads it instead of the intended library. Once loaded, the attacker's code runs inside the host process with that process's privileges. The issue affects all supported SQL Server major versions from 2016 through 2022 on x64 platforms.

Root Cause

The root cause is improper restriction of the library search path [CWE-426]. The component does not pin dependency resolution to a fully qualified, trusted directory before invoking a DLL load. Standard Windows search order then permits resolution from the application directory or other writable locations, depending on how the host is launched. This pattern is commonly described as DLL search-order hijacking or DLL planting.

Attack Vector

Exploitation is local and requires user interaction. The attacker must already have a way to drop a file into a directory that participates in the search path, and a user or service must subsequently load the vulnerable component. Common preconditions include a foothold on the host as an unprivileged user, an installer running from a user-writable working directory, or a tool that loads the XEvent configuration assembly while the user opens a crafted file or workspace. The published CVSS vector reflects local attack vector, low attack complexity, no privileges required, and required user interaction, with high impact across confidentiality, integrity, and availability. Microsoft has not reported in-the-wild exploitation, the CVE is not on the CISA KEV list, and no public proof-of-concept exploit is referenced in the NVD record.

Detection Methods for CVE-2024-49043

Indicators of Compromise

Unexpected DLL files written next to SQL Server tooling, management studio installations, or scripts that invoke XEvent configuration.
New or unsigned DLLs in user-writable directories that share a name with a Microsoft SQL Server dependency.
sqlservr.exe, ssms.exe, or PowerShell processes loading modules from non-standard paths such as user profile or temp directories.
Outbound network connections or child process creation initiated by SQL Server-related processes that do not match historical behavior.

Detection Strategies

Monitor Sysmon Event ID 7 (Image Loaded) for SQL Server processes loading Microsoft.SqlServer.XEvent.Configuration.dll or its dependencies from non-standard paths.
Hunt for module loads where the signer of the DLL is not Microsoft while the loading binary is a Microsoft-signed SQL Server component.
Alert on file write events that create DLL names matching SQL Server dependencies inside user-writable working directories.
Correlate process creation chains where sqlservr.exe or SQL tooling spawns command interpreters, scripting hosts, or LOLBins shortly after a DLL load.

Monitoring Recommendations

Baseline the legitimate module load paths for SQL Server installations and alert on deviations.
Forward Windows Security, Sysmon, and SQL Server error logs to a centralized analytics platform for retroactive hunting.
Track integrity of installation directories using file integrity monitoring focused on .dll and .exe changes outside patch windows.

How to Mitigate CVE-2024-49043

Immediate Actions Required

Apply the Microsoft security update for CVE-2024-49043 to every affected SQL Server 2016, 2017, 2019, and 2022 instance referenced in the Microsoft Security Update Guide.
Inventory hosts that run SQL Server tooling, including developer workstations and jump servers, since the vulnerable assembly ships beyond database servers.
Restrict write permissions on SQL Server installation and working directories so unprivileged users cannot plant DLLs.
Review recent file creation events in those directories for suspicious DLLs that predate patching.

Patch Information

Microsoft addressed CVE-2024-49043 in cumulative updates and security patches listed in the Microsoft Security Update Guide. Administrators should select the build that matches each instance's branch (SQL Server 2016 SP3, 2017, 2019, and 2022) and validate the patched version of Microsoft.SqlServer.XEvent.Configuration.dll after installation.

Workarounds

Run SQL Server tooling only from trusted, ACL-protected directories where standard users cannot create files.
Enforce application allowlisting with Windows Defender Application Control or AppLocker to block unsigned DLLs from loading into Microsoft-signed processes.
Limit interactive logon on database hosts to administrators required for operations, reducing the local foothold needed for exploitation.

bash

# Verify the patched module version on a SQL Server host (PowerShell)
Get-ChildItem -Path 'C:\Program Files\Microsoft SQL Server' -Recurse -Filter 'Microsoft.SqlServer.XEvent.Configuration.dll' |
    ForEach-Object {
        [PSCustomObject]@{
            Path    = $_.FullName
            Version = (Get-Item $_.FullName).VersionInfo.FileVersion
            Signed  = (Get-AuthenticodeSignature $_.FullName).Status
        }
    }