First addressed by Microsoft on December 10, 2024, as part of its monthly Patch Tuesday updates, this vulnerability has been assigned a critical CVSS score of 9.8, underlining the serious threat it poses to enterprise environments.
CVE-2024-49112, a remote code execution (RCE) flaw, primarily impacts Windows servers, including Domain Controllers (DCs). These servers play an essential role in managing network authentication and user access.
This vulnerability could enable attackers to disrupt unpatched servers by causing crashes or running arbitrary code within the LDAP service, potentially leading to full domain compromise.
The issue arises from an integer overflow in the LDAP-related code. By sending specifically crafted RPC requests, an unauthenticated attacker can initiate malicious LDAP queries. If exploited, this flaw could result in server instability or be leveraged to achieve remote code execution (RCE).
Proof-of-Concept Released for CVE-2024-49112
SafeBreach Labs has unveiled a zero-click proof-of-concept (PoC) exploit, named "LDAPNightmare," to highlight the severity of CVE-2024-49112. This exploit demonstrates how unpatched Windows servers can be crashed using the following attack sequence:
- The attacker initiates the process by sending a DCE/RPC request to the targeted server.
- The target server queries the attacker's DNS server for additional details.
- In response, the attacker provides a hostname and LDAP port.
- The victim server then broadcasts an NBNS request to resolve the attacker’s hostname.
- The attacker replies with their IP address.
- The victim server, now acting as an LDAP client, sends a CLDAP request to the attacker's machine.
- The attacker delivers a malicious referral response, triggering a crash in the LSASS (Local Security Authority Subsystem Service) and forcing the server to reboot.
This attack flow highlights the risk posed by the vulnerability.
All unpatched versions of Windows Server, including 2019 and 2022, are exposed to this vulnerability. Threat actors, such as ransomware groups, could exploit it to seize control of domain environments, placing them at significant risk.
Actions for Organisations
2. Keep an eye out for unusual activity involving DNS SRV queries, CLDAP referral responses, and DsrGetDcNameEx2 calls until the update is fully applied.
3. Utilise SafeBreach's proof-of-concept tool, accessible on GitHub, to assess your systems.
The availability of this PoC emphasises the critical need to address CVE-2024-49112 promptly. SafeBreach's findings shed light on the severity of the vulnerability while equipping organisations with resources to evaluate their security measures and remind them of the importance of patching.