Palo Alto Networks Discloses New Attack Surface Targeting Microsoft IIS and SQL Server at Black Hat Asia 2021
Summary: Unit 42 disclosed at Black Hat Asia 2021 a technique that lets attackers execute SQL queries against a remote, attacker-controlled database in Microsoft IIS and SQL Server via SQL injection or ad hoc scenarios, exploiting the remote database access feature in the Jet Database Engine (MS Jet and ACE). The researchers found around 100 Jet vulnerabilities in three months, and Microsoft's May 2021 Patch Tuesday update assigned CVE-2021-28455 and added an AllowQueryRemoteTables registry option to disable remote database access, but it is enabled by default and most Jet vulnerabilities remain unpatched.
Key Takeaway: A single SQL injection can hand an attacker SYSTEM privilege on IIS and SQL Server, and the mitigation Microsoft shipped is off by default, so the exposure persists unless an administrator sets AllowQueryRemoteTables to 0 in the registry.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026