Vlad Druma slides some data past the bouncer:
In this post I cover how an attacker can take advantage of SQL Server 2025’s sp_invoke_external_rest_endpoint to exfiltrate data from a compromised instance.
In my previous post I used sp_invoke_external_rest_endpoint to get some data about internet-exposed SQL Server instances.
While doing that, I realized that, similarly to xp_cmdshell, SQL Server 2025’s sp_invoke_external_rest_endpoint can be used by an attacker to exfiltrate data from SQL Server.
Click through to see how.