CVE-2024-43468: Microsoft Configuration Manager -- Unauthenticated SQL Injection RCE

Background

Microsoft Configuration Manager (formerly SCCM, now part of Microsoft Endpoint Manager) is the enterprise IT management platform used by large organizations to deploy software, manage patches, inventory hardware, and enforce security policy across tens of thousands of Windows endpoints. It holds complete inventories of enterprise IT assets and has administrative access to every managed device.

CVE-2024-43468 is a critical unauthenticated SQL injection vulnerability (CWE-89) in Configuration Manager. An attacker can send specially crafted HTTP requests to the ConfigMgr server that contain SQL injection payloads, leading to command execution on both the web server and the underlying SQL Server database. CISA added this to the KEV catalog on 2026-02-12.

A compromised SCCM/ConfigMgr server gives an attacker administrative reach over every managed Windows endpoint in the organisation — software deployment, script execution, policy modification, all available without further exploitation.

Technical Mechanism

CWE-89 (SQL Injection) occurs when user-supplied data is incorporated into SQL queries without parameterization or proper sanitization, allowing attackers to modify query logic.

POST /ConfigMgr_Proxy_MobileClient/ClientCertificateRegister HTTP/1.1
Host: sccm.enterprise.com
Content-Type: application/json

{
  "clientId": "test'; EXEC xp_cmdshell 'powershell -enc <b64payload>'; --"
}

With xp_cmdshell enabled on the SQL Server (common in ConfigMgr deployments due to required SQL permissions), the injected SQL executes OS commands with SQL Server service account privileges — typically a domain service account with significant enterprise permissions.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. Nation-state groups and ransomware operators specifically target SCCM as a lateral movement and persistence mechanism. From a compromised SCCM server, attackers can push malicious software to all managed devices, run scripts with SYSTEM privileges on any managed endpoint, and enumerate the entire enterprise asset inventory.

Impact Assessment

• Unauthenticated SQL injection with OS command execution on ConfigMgr/SQL Server
• Administrative access to the enterprise’s entire managed device fleet
• Ability to deploy malware or ransomware to all managed endpoints simultaneously
• Full enterprise asset inventory and credentials for all managed systems
• Domain escalation potential via SCCM’s Active Directory integration

Affected Versions

Remediation Steps

1. Apply Microsoft’s security update for CVE-2024-43468 immediately.
2. Restrict ConfigMgr management point access to internal networks only.
3. Disable xp_cmdshell on the ConfigMgr SQL Server if not explicitly required.
4. Audit ConfigMgr deployment history for unauthorized software pushes.
5. Review ConfigMgr admin accounts for unauthorized additions.
6. Rotate ConfigMgr service account credentials and SQL connection strings.

Detection Guidance

Log Sources: IIS/web server logs, SQL Server audit logs, Windows Event Logs, SCCM audit logs.

IOCs: SQL error messages or unexpected queries in ConfigMgr logs; xp_cmdshell execution in SQL Server audit trail; unusual software deployments pushed via SCCM; outbound connections from SQL Server service account.

Sigma rule:

title: SCCM SQL Injection Exploitation CVE-2024-43468
logsource:
  product: windows
  service: application
detection:
  selection:
    Source: "MSSQLSERVER"
    EventID: 15457  # xp_cmdshell execution
  condition: selection
level: critical

Timeline

References

• NVD — CVE-2024-43468
• CISA KEV — CVE-2024-43468
• Microsoft MSRC — CVE-2024-43468