CVE-2024-49043
Untrusted Search Path (CWE-426)
Summary
A remote code execution vulnerability exists in Microsoft.SqlServer.XEvent.Configuration.dll. This vulnerability is associated with untrusted search paths and uncontrolled search path elements. It requires local access and user interaction to exploit. The vulnerability has a CVSS base score of 7.8, indicating a high severity. It affects Microsoft SQL Server.
Impact
If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code with high impacts on confidentiality, integrity, and availability of the affected system. The attack vector is local, requiring user interaction, but no privileges are needed to initiate the attack. This could potentially lead to unauthorized access, data manipulation, or system disruption within the context of SQL Server operations.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft released a security update on November 12, 2024, to address this vulnerability.
Mitigation
1. Apply the security update provided by Microsoft as soon as possible. 2. Implement the principle of least privilege, limiting user access rights to minimize the potential impact of exploitation. 3. Monitor and control the search paths used by SQL Server components, particularly those related to XEvent configurations. 4. Educate users about the risks of interacting with untrusted content or executables, especially in the context of SQL Server operations. 5. Implement application whitelisting to prevent unauthorized executables from running. 6. Regularly audit and review system configurations and search paths to identify and rectify potential vulnerabilities.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Timeline
A CVSS base score of 7.8 has been assigned.
NVD published the first details for CVE-2024-49043
Feedly found the first article mentioning CVE-2024-49043. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.05% (Percentile: 22.9%)
Detection for the vulnerability has been added to Nessus (211471)
Detection for the vulnerability has been added to Nessus (211472)
EPSS Score was set to: 0.05% (Percentile: 20.9%)