CVE-2024-21375
📋 TL;DR
This vulnerability allows remote code execution through the Microsoft WDAC OLE DB provider for SQL Server. An attacker could exploit this to execute arbitrary code on affected systems. Organizations using SQL Server with WDAC OLE DB provider are affected.
💻 Affected Systems
- Microsoft SQL Server
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Attacker gains SYSTEM-level privileges on the SQL Server host, enabling data exfiltration and lateral movement.
If Mitigated
Limited impact due to network segmentation, least privilege, and proper monitoring.
🎯 Exploit Status
Exploitation requires specific conditions and may involve memory corruption techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific versions
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21375
Restart Required: Yes
Instructions:
1. Apply the latest Microsoft SQL Server security update. 2. Restart SQL Server services. 3. Verify patch installation.
🔧 Temporary Workarounds
Disable WDAC OLE DB provider
windowsRemove or disable the vulnerable component if not required.
Consult Microsoft documentation for disabling specific OLE DB providers
Network segmentation
allRestrict access to SQL Server ports (1433, 1434) to trusted networks only.
🧯 If You Can't Patch
- Implement strict network access controls to limit SQL Server exposure
- Enable enhanced logging and monitoring for suspicious SQL Server activities
🔍 How to Verify
Check if Vulnerable:
Check SQL Server version and installed updates against Microsoft advisoryCheck Version:
SELECT @@VERSIONVerify Fix Applied:
Verify security update is installed via Windows Update history or SQL Server version check📡 Detection & Monitoring
Log Indicators:
- Unusual SQL Server process creation
- Suspicious OLE DB provider usage
Network Indicators:
- Anomalous connections to SQL Server ports
- Unexpected network traffic from SQL Server
SIEM Query:
Process creation where parent process contains 'sqlservr.exe' and command line contains suspicious parameters