CVE-2024-43468: Microsoft Configuration Manager SQL Injection Vulnerability

Microsoft Configuration Manager contains an SQL injection vulnerability tracked as CVE-2024-43468. An unauthenticated attacker can send specially crafted requests that the product processes in an unsafe manner, allowing execution of commands on the server or its underlying database. The issue matters because Configuration Manager often holds broad administrative control over enterprise devices and data stores.

How it works

The weakness is categorized as CWE-89, an improper neutralization of special elements used in an SQL command. An attacker supplies input that is concatenated into SQL statements without adequate sanitization or parameterization. When the application executes the resulting query, the injected syntax alters the intended command, enabling the attacker to read, modify, or control data and potentially issue operating-system commands through database features.

Am I affected? How to find it in your systems

• Inventory all Microsoft Configuration Manager sites, including primary, secondary, and central administration sites, as well as any connected SQL Server instances.
• Review the vendor advisory for the precise build numbers and configuration settings that require checking.
• Examine web service endpoints and management point traffic for unusually long or malformed request parameters that could indicate testing for injection.
• Monitor SQL Server logs and Configuration Manager component logs for unexpected query patterns, error messages containing SQL syntax, or sudden privilege escalations within the database.

How to remediate

Apply the vendor-supplied update referenced in the Microsoft security advisory. After patching, confirm that the affected components have been restarted and that any required post-installation steps have been completed. Review Configuration Manager’s database access controls and ensure service accounts follow the principle of least privilege.

If you can't patch immediately

• Restrict network access to Configuration Manager endpoints so that only trusted management consoles and site servers can reach them.
• Enable or strengthen web application firewall rules that inspect and block requests containing common SQL metacharacters on exposed interfaces.
• Monitor authentication and query logs more closely for indicators of reconnaissance or exploitation attempts.
• Follow CISA guidance on applicable BOD 22-01 controls for any cloud-hosted elements and consider temporary isolation of the environment if mitigations cannot be applied.

If your data may have been exposed

SQL injection flaws that permit unauthenticated command execution have been used to obtain persistent access and exfiltrate data. Organizations can run a free exposure scan of their domains and email addresses against known breach datasets to determine whether related credentials or records already appear in public breach corpora.