CVE-2023-29372
📋 TL;DR
This vulnerability in Microsoft's WDAC OLE DB provider for SQL Server allows remote attackers to execute arbitrary code on affected systems by sending specially crafted queries. It affects systems running vulnerable versions of SQL Server with the WDAC OLE DB provider enabled. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Microsoft SQL Server
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with administrative privileges, data exfiltration, lateral movement across network, and persistent backdoor installation.
Likely Case
Database compromise leading to data theft, privilege escalation, and potential ransomware deployment.
If Mitigated
Limited impact due to network segmentation, minimal privileges, and proper monitoring catching exploitation attempts.
🎯 Exploit Status
Requires authentication to SQL Server but no additional privileges. Exploitation involves crafting specific OLE DB queries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29372
Restart Required: Yes
Instructions:
1. Apply latest SQL Server cumulative update from Microsoft. 2. Restart SQL Server services. 3. Verify patch installation via version check.
🔧 Temporary Workarounds
Disable WDAC OLE DB provider
windowsTemporarily disable the vulnerable component if not required for operations
-- Requires SQL Server configuration changes
-- Consult Microsoft documentation for specific steps
Network segmentation
windowsRestrict access to SQL Server ports (1433, 1434) to only trusted hosts
netsh advfirewall firewall add rule name="Block SQL" dir=in action=block protocol=TCP localport=1433,1434 remoteip=any
🧯 If You Can't Patch
- Implement strict network access controls to limit SQL Server exposure
- Apply principle of least privilege to SQL Server service accounts and database users
🔍 How to Verify
Check if Vulnerable:
Check SQL Server version against patched versions in Microsoft advisory. Verify WDAC OLE DB provider is enabled.Check Version:
SELECT @@VERSION;Verify Fix Applied:
Confirm SQL Server build number matches or exceeds patched version from Microsoft advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual OLE DB provider usage patterns
- Failed authentication attempts followed by successful connections
- Unusual query patterns targeting WDAC functionality
Network Indicators:
- Unusual traffic to SQL Server ports from unexpected sources
- Large or malformed OLE DB packets
SIEM Query:
source="sql_server" AND (event_id=18456 OR event_id=33205) AND user NOT IN (expected_users)